Repository: linkerd/linkerd2
Pull request #7738 (2022-01-31 03:13:06)

build(deps): bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.12.0 to 1.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's releases</a>.</em></p>
<blockquote>
<h2>1.12.1 / 2022-01-29</h2>
<ul>
<li>[BUGFIX] Make the Go 1.17 collector concurrency-safe <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/969">#969</a>
<ul>
<li>Use simpler locking in the Go 1.17 collector <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/975">#975</a></li>
</ul>
</li>
<li>[BUGFIX] Reduce granularity of histogram buckets for Go 1.17 collector <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/974">#974</a></li>
<li>[ENHANCEMENT] API client: make HTTP reads more efficient <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/976">#976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/client_golang/compare/v1.12.0...v1.12.1">https://github.com/prometheus/client_golang/compare/v1.12.0...v1.12.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's changelog</a>.</em></p>
<blockquote>
<h2>1.12.1 / 2022-01-29</h2>
<ul>
<li>[BUGFIX] Make the Go 1.17 collector concurrency-safe <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/969">#969</a>
<ul>
<li>Use simpler locking in the Go 1.17 collector <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/975">#975</a></li>
</ul>
</li>
<li>[BUGFIX] Reduce granularity of histogram buckets for Go 1.17 collector <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/974">#974</a></li>
<li>[ENHANCEMENT] API client: make HTTP reads more efficient <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/976">#976</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/prometheus/client_golang/commit/2e1c4818ccfdcf953ce399cadad615ff2bed968c"><code>2e1c481</code></a> Cut v1.12.1 (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/978">#978</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/77626d64fa02954e546be20b688e235617e42c7e"><code>77626d6</code></a> Reduce granularity of histogram buckets for Go 1.17 collector (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/974">#974</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/4dd3cbb4ab52a73d9046b721b5b5bdffa9e10922"><code>4dd3cbb</code></a> API client: make http reads more efficient (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/976">#976</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/85206714ae0528f3c7b303a69c0a7383e1f99673"><code>8520671</code></a> Use simpler locking in the Go 1.17 collector (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/975">#975</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/f63e219e6b9074f8a55c8475e7b11720bdfc3737"><code>f63e219</code></a> Make the Go 1.17 collector thread-safe (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/969">#969</a>)</li>
<li>See full diff in <a href="https://github.com/prometheus/client_golang/compare/v1.12.0...v1.12.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.12.0&new-version=1.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/ADOPTERS.md b/ADOPTERS.md
index a7e3ece7e..f78ddc928 100644
--- a/ADOPTERS.md
+++ b/ADOPTERS.md
@@ -7,6 +7,7 @@
 - [ANNA Money](https://anna.money)
 - [Apester](https://apester.com)
 - [AppddictionStudio](https://appddicitonstudio.com)
+- [AT&T](<https://il.att.com/>)
 - [Attest](https://www.askattest.com)
 - [Bede Gaming](https://bedegaming.com)
 - [Bink](https://bink.com)
diff --git a/Cargo.lock b/Cargo.lock
index 865156b34..c4c26da49 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -778,7 +778,7 @@ dependencies = [
  "json-patch",
  "k8s-openapi",
  "kube-client",
- "parking_lot",
+ "parking_lot 0.11.2",
  "pin-project",
  "serde",
  "serde_json",
@@ -797,9 +797,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.115"
+version = "0.2.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a8d982fa7a96a000f6ec4cfe966de9703eccde29750df2bb8949da91b0e818d"
+checksum = "565dbd88872dbe4cc8a46e527f26483c1d1f7afa6b884a3bd6cd893d4f98da74"
 
 [[package]]
 name = "linked-hash-map"
@@ -883,7 +883,7 @@ dependencies = [
  "futures",
  "linkerd-policy-controller-core",
  "linkerd-policy-controller-k8s-api",
- "parking_lot",
+ "parking_lot 0.12.0",
  "tokio",
  "tracing",
 ]
@@ -904,9 +904,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712a4d093c9976e24e7dbca41db895dabcbac38eb5f4045393d17a95bdfb1109"
+checksum = "88943dd7ef4a2e5a4bfa2753aaab3013e34ce2533d1996fb18ef591e315e2b3b"
 dependencies = [
  "scopeguard",
 ]
@@ -1090,7 +1090,17 @@ checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
 dependencies = [
  "instant",
  "lock_api",
- "parking_lot_core",
+ "parking_lot_core 0.8.5",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f5ec2493a61ac0506c0f4199f99070cbe83857b0337006a30f3e6719b8ef58"
+dependencies = [
+ "lock_api",
+ "parking_lot_core 0.9.0",
 ]
 
 [[package]]
@@ -1107,6 +1117,19 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "parking_lot_core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2f4f894f3865f6c0e02810fc597300f34dc2510f66400da262d8ae10e75767d"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-sys",
+]
+
 [[package]]
 name = "pem"
 version = "1.0.2"
@@ -1481,9 +1504,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d09d3c15d814eda1d6a836f2f2b56a6abc1446c8a34351cb3180d3db92ffe4ce"
+checksum = "3fed7948b6c68acbb6e20c334f55ad635dc0f75506963de4464289fbd3b051ac"
 dependencies = [
  "bitflags",
  "core-foundation",
@@ -1494,9 +1517,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e90dd10c41c6bfc633da6e0c659bd25d31e0791e5974ac42970267d59eba87f7"
+checksum = "a57321bf8bc2362081b2599912d2961fe899c0efadf1b4b2f8d48b3e253bb96c"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1692,9 +1715,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.16.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95e99d373042c30406d317cfc5bfad7b5d604bdd31dab72cf8739abebaa64aee"
+checksum = "0c27a64b625de6d309e8c57716ba93021dccf1b3b5c97edd6d3dd2d2135afc0a"
 dependencies = [
  "bytes",
  "libc",
@@ -1702,7 +1725,7 @@ dependencies = [
  "mio",
  "num_cpus",
  "once_cell",
- "parking_lot",
+ "parking_lot 0.11.2",
  "pin-project-lite",
  "signal-hook-registry",
  "tokio-macros",
@@ -2125,6 +2148,49 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows-sys"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ceb069ac8b2117d36924190469735767f0990833935ab430155e71a44bafe148"
+dependencies = [
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d027175d00b01e0cbeb97d6ab6ebe03b12330a35786cbaca5252b1c4bf5d9b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8793f59f7b8e8b01eda1a652b2697d87b93097198ae85f823b969ca5b89bba58"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8602f6c418b67024be2996c512f5f995de3ba417f4c75af68401ab8756796ae4"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3d615f419543e0bd7d2b3323af0d86ff19cbc4f816e6453f36a2c2ce889c354"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d95421d9ed3672c280884da53201a5c46b7b2765ca6faf34b0d71cf34a3561"
+
 [[package]]
 name = "yaml-rust"
 version = "0.4.5"
diff --git a/charts/linkerd-control-plane/templates/destination.yaml b/charts/linkerd-control-plane/templates/destination.yaml
index 5d273a046..765606678 100644
--- a/charts/linkerd-control-plane/templates/destination.yaml
+++ b/charts/linkerd-control-plane/templates/destination.yaml
@@ -118,7 +118,6 @@ spec:
 {{- $tree := deepCopy . }}
 {{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}}
 {{ $_ := set $tree.Values.proxy "component" "linkerd-destination" -}}
-{{ include "linkerd.proxy.validation" .Values.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/charts/linkerd-control-plane/templates/identity.yaml b/charts/linkerd-control-plane/templates/identity.yaml
index c80ccb112..52e3b5b11 100644
--- a/charts/linkerd-control-plane/templates/identity.yaml
+++ b/charts/linkerd-control-plane/templates/identity.yaml
@@ -94,7 +94,6 @@ spec:
 {{- $tree := deepCopy . }}
 {{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}}
 {{ $_ := set $tree.Values.proxy "component" "linkerd-identity" -}}
-{{ include "linkerd.proxy.validation" .Values.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/charts/linkerd-control-plane/templates/proxy-injector.yaml b/charts/linkerd-control-plane/templates/proxy-injector.yaml
index 46823163f..b0be8a4f5 100644
--- a/charts/linkerd-control-plane/templates/proxy-injector.yaml
+++ b/charts/linkerd-control-plane/templates/proxy-injector.yaml
@@ -5,7 +5,6 @@
 {{- $tree := deepCopy . }}
 {{ $_ := set $tree.Values.proxy "workloadKind" "deployment" -}}
 {{ $_ := set $tree.Values.proxy "component" "linkerd-proxy-injector" -}}
-{{ include "linkerd.proxy.validation" .Values.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/charts/partials/templates/_metadata.tpl b/charts/partials/templates/_metadata.tpl
index 0a1c24ded..9ac8e7e0a 100644
--- a/charts/partials/templates/_metadata.tpl
+++ b/charts/partials/templates/_metadata.tpl
@@ -7,7 +7,6 @@ linkerd.io/created-by: {{ .Values.cliVersion | default (printf "linkerd/helm %s"
 {{- end -}}
 
 {{- define "partials.proxy.annotations" -}}
-linkerd.io/identity-mode: {{ternary "default" "disabled" (not .Values.proxy.disableIdentity)}}
 linkerd.io/proxy-version: {{.Values.proxy.image.version | default .Values.linkerdVersion}}
 {{- end -}}
 
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index 46a08be02..b27187dca 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -87,10 +87,6 @@ env:
 - name: LINKERD2_PROXY_DESTINATION_CONTEXT
   value: |
     {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)"}
-{{ if .Values.proxy.disableIdentity -}}
-- name: LINKERD2_PROXY_IDENTITY_DISABLED
-  value: disabled
-{{ else -}}
 - name: _pod_sa
   valueFrom:
     fieldRef:
@@ -128,7 +124,6 @@ be used in other contexts.
   value: linkerd-destination.{{.Release.Namespace}}.serviceaccount.identity.{{.Release.Namespace}}.{{$trustDomain}}
 - name: LINKERD2_PROXY_POLICY_SVC_NAME
   value: linkerd-destination.{{.Release.Namespace}}.serviceaccount.identity.{{.Release.Namespace}}.{{$trustDomain}}
-{{ end -}}
 {{ if .Values.proxy.accessLog -}}
 - name: LINKERD2_PROXY_ACCESS_LOG
   value: {{.Values.proxy.accessLog | quote}}
@@ -178,20 +173,16 @@ lifecycle:
         - {{.Values.proxy.waitBeforeExitSeconds | quote}}
 {{- end }}
 {{- end }}
-{{- if or (not .Values.proxy.disableIdentity) (.Values.proxy.saMountPath) }}
 volumeMounts:
-{{- if not .Values.proxy.disableIdentity }}
 - mountPath: /var/run/linkerd/identity/end-entity
   name: linkerd-identity-end-entity
 {{- if .Values.identity.serviceAccountTokenProjection }}
 - mountPath: /var/run/secrets/tokens
   name: linkerd-identity-token
 {{- end }}
-{{- end -}}
 {{- if .Values.proxy.saMountPath }}
 - mountPath: {{.Values.proxy.saMountPath.mountPath}}
   name: {{.Values.proxy.saMountPath.name}}
   readOnly: {{.Values.proxy.saMountPath.readOnly}}
 {{- end -}}
-{{- end -}}
 {{- end }}
diff --git a/charts/partials/templates/_validate.tpl b/charts/partials/templates/_validate.tpl
index 5642c2e8f..ba772c2fe 100644
--- a/charts/partials/templates/_validate.tpl
+++ b/charts/partials/templates/_validate.tpl
@@ -1,9 +1,3 @@
-{{- define "linkerd.proxy.validation" -}}
-{{- if .disableIdentity -}}
-{{- fail (printf "Can't disable identity mTLS for %s. Set '.Values.proxy.disableIdentity' to 'false'" .component) -}}
-{{- end -}}
-{{- end -}}
-
 {{- define "linkerd.webhook.validation" -}}
 
 {{- if and (.injectCaFrom) (.injectCaFromSecret) -}}
@@ -22,4 +16,4 @@
 {{- fail "if caBundle, injectCaFrom, or injectCaFromSecret is set, then externalSecret must be set" -}}
 {{- end -}}
 
-{{- end -}}
\ No newline at end of file
+{{- end -}}
diff --git a/charts/patch/templates/patch.json b/charts/patch/templates/patch.json
index 017205371..fd3697eef 100644
--- a/charts/patch/templates/patch.json
+++ b/charts/patch/templates/patch.json
@@ -76,7 +76,6 @@
   },
   {{- end }}
   {{- if .Values.proxy }}
-  {{- if not .Values.proxy.disableIdentity -}}
   {
     "op": "add",
     "path": "{{$prefix}}/spec/volumes/-",
@@ -95,7 +94,6 @@
       {{- include "partials.proxy.volumes.service-account-token" . | fromYaml | toPrettyJson | nindent 6 }}
   },
   {{- end }}
-  {{- end }}
   {
     "op": "add",
   {{- if .Values.proxy.await }}
diff --git a/cli/cmd/doc.go b/cli/cmd/doc.go
index c8ee973aa..9628051c5 100644
--- a/cli/cmd/doc.go
+++ b/cli/cmd/doc.go
@@ -212,10 +212,6 @@ func generateAnnotationsDocs() []annotationDoc {
 			Name:        k8s.ProxyVersionOverrideAnnotation,
 			Description: "Tag to be used for the Linkerd proxy images",
 		},
-		{
-			Name:        k8s.ProxyDisableIdentityAnnotation,
-			Description: "Disables resources from participating in TLS identity",
-		},
 		{
 			Name:        k8s.ProxyEnableDebugAnnotation,
 			Description: "Inject a debug sidecar for data plane debugging",
diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
index 44070a55e..15ee2feaa 100644
--- a/cli/cmd/inject.go
+++ b/cli/cmd/inject.go
@@ -446,10 +446,6 @@ func getOverrideAnnotations(values *charts.Values, base *charts.Values) map[stri
 		overrideAnnotations[k8s.ProxyLogFormatAnnotation] = proxy.LogFormat
 	}
 
-	if proxy.DisableIdentity != baseProxy.DisableIdentity {
-		overrideAnnotations[k8s.ProxyDisableIdentityAnnotation] = strconv.FormatBool(proxy.DisableIdentity)
-	}
-
 	if proxy.RequireIdentityOnInboundPorts != baseProxy.RequireIdentityOnInboundPorts {
 		overrideAnnotations[k8s.ProxyRequireIdentityOnInboundPortsAnnotation] = proxy.RequireIdentityOnInboundPorts
 	}
diff --git a/cli/cmd/options.go b/cli/cmd/options.go
index 66e4c757c..f6e28a948 100644
--- a/cli/cmd/options.go
+++ b/cli/cmd/options.go
@@ -469,10 +469,9 @@ func makeInjectFlags(defaults *l5dcharts.Values) ([]flag.Flag, *pflag.FlagSet) {
 				return nil
 			}),
 
-		flag.NewBoolFlag(injectFlags, "disable-identity", defaults.Proxy.DisableIdentity,
+		flag.NewBoolFlag(injectFlags, "disable-identity", false,
 			"Disables resources from participating in TLS identity", func(values *l5dcharts.Values, value bool) error {
-				values.Proxy.DisableIdentity = value
-				return nil
+				return errors.New("--disable-identity is no longer supported; identity is always required")
 			}),
 
 		flag.NewStringSliceFlag(injectFlags, "require-identity-on-inbound-ports", strings.Split(defaults.Proxy.RequireIdentityOnInboundPorts, ","),
@@ -493,6 +492,7 @@ func makeInjectFlags(defaults *l5dcharts.Values) ([]flag.Flag, *pflag.FlagSet) {
 				return nil
 			}),
 	}
+	injectFlags.MarkHidden("disable-identity")
 
 	return flags, injectFlags
 }
@@ -574,10 +574,6 @@ func validateProxyValues(values *l5dcharts.Values) error {
 		}
 	}
 
-	if values.Proxy.DisableIdentity && len(values.Proxy.RequireIdentityOnInboundPorts) > 0 {
-		return errors.New("Identity must be enabled when  --require-identity-on-inbound-ports is specified")
-	}
-
 	if values.Proxy.Image.Version != "" && !alphaNumDashDot.MatchString(values.Proxy.Image.Version) {
 		return fmt.Errorf("%s is not a valid version", values.Proxy.Image.Version)
 	}
diff --git a/controller/api/destination/endpoint_translator.go b/controller/api/destination/endpoint_translator.go
index 34a599503..dafd17db0 100644
--- a/controller/api/destination/endpoint_translator.go
+++ b/controller/api/destination/endpoint_translator.go
@@ -376,7 +376,6 @@ func createWeightedAddr(address watcher.Address, opaquePorts map[uint32]struct{}
 	// multiple meshes can participate in identity if they share trust roots.
 	if identityTrustDomain != "" &&
 		controllerNSLabel == controllerNS &&
-		address.Pod.Annotations[k8s.IdentityModeAnnotation] == k8s.IdentityModeDefault &&
 		!isSkippedInboundPort {
 
 		id := fmt.Sprintf("%s.%s.serviceaccount.identity.%s.%s", sa, ns, controllerNSLabel, identityTrustDomain)
diff --git a/controller/cmd/destination/main.go b/controller/cmd/destination/main.go
index b6642f3d7..4db256012 100644
--- a/controller/cmd/destination/main.go
+++ b/controller/cmd/destination/main.go
@@ -26,7 +26,6 @@ func Main(args []string) {
 	metricsAddr := cmd.String("metrics-addr", ":9996", "address to serve scrapable metrics on")
 	kubeConfigPath := cmd.String("kubeconfig", "", "path to kube config")
 	enableH2Upgrade := cmd.Bool("enable-h2-upgrade", true, "Enable transparently upgraded HTTP2 connections among pods in the service mesh")
-	disableIdentity := cmd.Bool("disable-identity", false, "Disable identity configuration")
 	controllerNamespace := cmd.String("controller-namespace", "linkerd", "namespace in which Linkerd is installed")
 	enableEndpointSlices := cmd.Bool("enable-endpoint-slices", true, "Enable the usage of EndpointSlice informers and resources")
 	trustDomain := cmd.String("identity-trust-domain", "", "configures the name suffix used for identities")
@@ -47,13 +46,9 @@ func Main(args []string) {
 		log.Fatalf("Failed to listen on %s: %s", *addr, err)
 	}
 
-	if *disableIdentity {
-		log.Info("Identity is disabled")
-	} else {
-		if *trustDomain == "" {
-			*trustDomain = "cluster.local"
-			log.Warnf(" expected trust domain through args (falling back to %s)", *trustDomain)
-		}
+	if *trustDomain == "" {
+		*trustDomain = "cluster.local"
+		log.Warnf(" expected trust domain through args (falling back to %s)", *trustDomain)
 	}
 
 	if *clusterDomain == "" {
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 46d523c2b..7a8fb7f87 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -1,9 +1,4 @@
 [
-  {
-    "op": "add",
-    "path": "/metadata/annotations/linkerd.io~1identity-mode",
-    "value": "disabled"
-  },
   {
     "op": "add",
     "path": "/metadata/annotations/linkerd.io~1proxy-version",
@@ -102,6 +97,35 @@
       "terminationMessagePolicy": "FallbackToLogsOnError"
     }
   },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value": {
+      "name": "linkerd-identity-end-entity",
+      "emptyDir": {
+        "medium": "Memory"
+      }
+    }
+  },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value":
+      {
+        "name": "linkerd-identity-token",
+        "projected": {
+          "sources": [
+            {
+              "serviceAccountToken": {
+                "audience": "identity.l5d.io",
+                "expirationSeconds": 86400,
+                "path": "linkerd-identity-token"
+              }
+            }
+          ]
+        }
+      }
+  },
   {
     "op": "add",
     "path": "/spec/containers/0",
@@ -220,8 +244,44 @@
           "value": "{\"ns\":\"$(_pod_ns)\", \"nodeName\":\"$(_pod_nodeName)\"}\n"
         },
         {
-          "name": "LINKERD2_PROXY_IDENTITY_DISABLED",
-          "value": "disabled"
+          "name": "_pod_sa",
+          "valueFrom": {
+            "fieldRef": {
+              "fieldPath": "spec.serviceAccountName"
+            }
+          }
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_DIR",
+          "value": "/var/run/linkerd/identity/end-entity"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS",
+          "value": "IdentityTrustAnchorsPEM\n"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TOKEN_FILE",
+          "value": "/var/run/secrets/tokens/linkerd-identity-token"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_ADDR",
+          "value": "linkerd-identity-headless.linkerd.svc.cluster.local.:8080"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_LOCAL_NAME",
+          "value": "$(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_NAME",
+          "value": "linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_DESTINATION_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_POLICY_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
         }
       ],
       "image": "cr.l5d.io/linkerd/proxy:dev-undefined",
@@ -266,7 +326,17 @@
         "readOnlyRootFilesystem": true,
         "runAsUser": 2102
       },
-      "terminationMessagePolicy": "FallbackToLogsOnError"
+      "terminationMessagePolicy": "FallbackToLogsOnError",
+      "volumeMounts": [
+        {
+          "mountPath": "/var/run/linkerd/identity/end-entity",
+          "name": "linkerd-identity-end-entity"
+        },
+        {
+          "mountPath": "/var/run/secrets/tokens",
+          "name": "linkerd-identity-token"
+        }
+      ]
     }
   }
 ]
diff --git a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
index c44e2d05b..407eab8de 100644
--- a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
@@ -9,11 +9,6 @@
     "path": "/metadata/annotations/config.linkerd.io~1skip-outbound-ports",
     "value": "34567"
   },
-  {
-    "op": "add",
-    "path": "/metadata/annotations/linkerd.io~1identity-mode",
-    "value": "disabled"
-  },
   {
     "op": "add",
     "path": "/metadata/annotations/linkerd.io~1proxy-version",
@@ -102,6 +97,35 @@
       ]
     }
   },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value": {
+      "name": "linkerd-identity-end-entity",
+      "emptyDir": {
+        "medium": "Memory"
+      }
+    }
+  },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value":
+      {
+        "name": "linkerd-identity-token",
+        "projected": {
+          "sources": [
+            {
+              "serviceAccountToken": {
+                "audience": "identity.l5d.io",
+                "expirationSeconds": 86400,
+                "path": "linkerd-identity-token"
+              }
+            }
+          ]
+        }
+      }
+  },
   {
     "op": "add",
     "path": "/spec/containers/0",
@@ -220,8 +244,44 @@
           "value": "{\"ns\":\"$(_pod_ns)\", \"nodeName\":\"$(_pod_nodeName)\"}\n"
         },
         {
-          "name": "LINKERD2_PROXY_IDENTITY_DISABLED",
-          "value": "disabled"
+          "name": "_pod_sa",
+          "valueFrom": {
+            "fieldRef": {
+              "fieldPath": "spec.serviceAccountName"
+            }
+          }
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_DIR",
+          "value": "/var/run/linkerd/identity/end-entity"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS",
+          "value": "IdentityTrustAnchorsPEM\n"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TOKEN_FILE",
+          "value": "/var/run/secrets/tokens/linkerd-identity-token"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_ADDR",
+          "value": "linkerd-identity-headless.linkerd.svc.cluster.local.:8080"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_LOCAL_NAME",
+          "value": "$(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_NAME",
+          "value": "linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_DESTINATION_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_POLICY_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
         }
       ],
       "image": "cr.l5d.io/linkerd/proxy:dev-undefined",
@@ -274,7 +334,17 @@
         "readOnlyRootFilesystem": true,
         "runAsUser": 2102
       },
-      "terminationMessagePolicy": "FallbackToLogsOnError"
+      "terminationMessagePolicy": "FallbackToLogsOnError",
+      "volumeMounts": [
+        {
+          "mountPath": "/var/run/linkerd/identity/end-entity",
+          "name": "linkerd-identity-end-entity"
+        },
+        {
+          "mountPath": "/var/run/secrets/tokens",
+          "name": "linkerd-identity-token"
+        }
+      ]
     }
   }
 ]
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index dbbd77120..6d0d3ed7d 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -1,9 +1,4 @@
 [
-  {
-    "op": "add",
-    "path": "/metadata/annotations/linkerd.io~1identity-mode",
-    "value": "disabled"
-  },
   {
     "op": "add",
     "path": "/metadata/annotations/linkerd.io~1proxy-version",
@@ -92,6 +87,35 @@
       ]
     }
   },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value": {
+      "name": "linkerd-identity-end-entity",
+      "emptyDir": {
+        "medium": "Memory"
+      }
+    }
+  },
+  {
+    "op": "add",
+    "path": "/spec/volumes/-",
+    "value":
+      {
+        "name": "linkerd-identity-token",
+        "projected": {
+          "sources": [
+            {
+              "serviceAccountToken": {
+                "audience": "identity.l5d.io",
+                "expirationSeconds": 86400,
+                "path": "linkerd-identity-token"
+              }
+            }
+          ]
+        }
+      }
+  },
   {
     "op": "add",
     "path": "/spec/containers/0",
@@ -210,8 +234,44 @@
           "value": "{\"ns\":\"$(_pod_ns)\", \"nodeName\":\"$(_pod_nodeName)\"}\n"
         },
         {
-          "name": "LINKERD2_PROXY_IDENTITY_DISABLED",
-          "value": "disabled"
+          "name": "_pod_sa",
+          "valueFrom": {
+            "fieldRef": {
+              "fieldPath": "spec.serviceAccountName"
+            }
+          }
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_DIR",
+          "value": "/var/run/linkerd/identity/end-entity"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS",
+          "value": "IdentityTrustAnchorsPEM\n"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_TOKEN_FILE",
+          "value": "/var/run/secrets/tokens/linkerd-identity-token"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_ADDR",
+          "value": "linkerd-identity-headless.linkerd.svc.cluster.local.:8080"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_LOCAL_NAME",
+          "value": "$(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_IDENTITY_SVC_NAME",
+          "value": "linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_DESTINATION_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
+        },
+        {
+          "name": "LINKERD2_PROXY_POLICY_SVC_NAME",
+          "value": "linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local"
         }
       ],
       "image": "cr.l5d.io/linkerd/proxy:dev-undefined",
@@ -256,7 +316,17 @@
         "readOnlyRootFilesystem": true,
         "runAsUser": 2102
       },
-      "terminationMessagePolicy": "FallbackToLogsOnError"
+      "terminationMessagePolicy": "FallbackToLogsOnError",
+      "volumeMounts": [
+        {
+          "mountPath": "/var/run/linkerd/identity/end-entity",
+          "name": "linkerd-identity-end-entity"
+        },
+        {
+          "mountPath": "/var/run/secrets/tokens",
+          "name": "linkerd-identity-token"
+        }
+      ]
     }
   }
 ]
diff --git a/go.mod b/go.mod
index 49b6eb4de..230dabe1e 100644
--- a/go.mod
+++ b/go.mod
@@ -26,7 +26,7 @@ require (
 	github.com/nsf/termbox-go v0.0.0-20180613055208-5c94acc5e6eb
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/browser v0.0.0-20170505125900-c90ca0c84f15
-	github.com/prometheus/client_golang v1.12.0
+	github.com/prometheus/client_golang v1.12.1
 	github.com/prometheus/common v0.32.1
 	github.com/sergi/go-diff v1.2.0
 	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 // indirect
diff --git a/go.sum b/go.sum
index bfa5008ed..17a09f268 100644
--- a/go.sum
+++ b/go.sum
@@ -790,8 +790,8 @@ github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQ
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.0 h1:C+UIj/QWtmqY13Arb8kwMt5j34/0Z2iKamrJ+ryC0Gg=
-github.com/prometheus/client_golang v1.12.0/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_golang v1.12.1 h1:ZiaPsmm9uiBeaSMRznKsCDNtPCS0T3JVDGF+06gjBzk=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index af73c0bfc..e23f8170a 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -92,7 +92,6 @@ type (
 		Capabilities *Capabilities `json:"capabilities"`
 		// This should match .Resources.CPU.Limit, but must be a whole number
 		Cores                         int64            `json:"cores,omitempty"`
-		DisableIdentity               bool             `json:"disableIdentity"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
 		Image                         *Image           `json:"image"`
 		LogLevel                      string           `json:"logLevel"`
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index eee473d56..dee7df537 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -41,7 +41,6 @@ var (
 	ProxyAnnotations = []string{
 		k8s.ProxyAdminPortAnnotation,
 		k8s.ProxyControlPortAnnotation,
-		k8s.ProxyDisableIdentityAnnotation,
 		k8s.ProxyEnableDebugAnnotation,
 		k8s.ProxyEnableExternalProfilesAnnotation,
 		k8s.ProxyImagePullPolicyAnnotation,
@@ -280,10 +279,6 @@ func (conf *ResourceConfig) GetPodPatch(injectProxy bool) ([]byte, error) {
 		return nil, fmt.Errorf("could not generate Overridden Values: %s", err)
 	}
 
-	if values.Proxy.RequireIdentityOnInboundPorts != "" && values.Proxy.DisableIdentity {
-		return nil, fmt.Errorf("%s cannot be set when identity is disabled", k8s.ProxyRequireIdentityOnInboundPortsAnnotation)
-	}
-
 	if values.ClusterNetworks != "" {
 		for _, network := range strings.Split(strings.Trim(values.ClusterNetworks, ","), ",") {
 			if _, _, err := net.ParseCIDR(network); err != nil {
@@ -804,12 +799,6 @@ func (conf *ResourceConfig) injectObjectMeta(values *podPatch) {
 
 	values.Annotations[k8s.ProxyVersionAnnotation] = values.Proxy.Image.Version
 
-	if values.Identity == nil || values.Proxy.DisableIdentity {
-		values.Annotations[k8s.IdentityModeAnnotation] = k8s.IdentityModeDisabled
-	} else {
-		values.Annotations[k8s.IdentityModeAnnotation] = k8s.IdentityModeDefault
-	}
-
 	if len(conf.pod.labels) > 0 {
 		values.AddRootLabels = len(conf.pod.meta.Labels) == 0
 		for _, k := range sortedKeys(conf.pod.labels) {
@@ -914,13 +903,6 @@ func (conf *ResourceConfig) applyAnnotationOverrides(values *l5dcharts.Values) {
 		values.Proxy.LogFormat = override
 	}
 
-	if override, ok := annotations[k8s.ProxyDisableIdentityAnnotation]; ok {
-		value, err := strconv.ParseBool(override)
-		if err == nil {
-			values.Proxy.DisableIdentity = value
-		}
-	}
-
 	if override, ok := annotations[k8s.ProxyRequireIdentityOnInboundPortsAnnotation]; ok {
 		values.Proxy.RequireIdentityOnInboundPorts = override
 	}
diff --git a/pkg/k8s/labels.go b/pkg/k8s/labels.go
index 1423889f1..9143958c2 100644
--- a/pkg/k8s/labels.go
+++ b/pkg/k8s/labels.go
@@ -112,10 +112,6 @@ const (
 	// disable injection for a pod or namespace.
 	ProxyInjectDisabled = Disabled
 
-	// IdentityModeAnnotation controls how a pod participates
-	// in service identity.
-	IdentityModeAnnotation = Prefix + "/identity-mode"
-
 	/*
 	 * Proxy config annotations
 	 */
@@ -234,9 +230,6 @@ const (
 	// to operate as a gateway, routing requests that target the inbound router.
 	ProxyEnableGatewayAnnotation = ProxyConfigAnnotationsPrefix + "/enable-gateway"
 
-	// ProxyDisableIdentityAnnotation can be used to disable identity on the injected proxy.
-	ProxyDisableIdentityAnnotation = ProxyConfigAnnotationsPrefix + "/disable-identity"
-
 	// ProxyEnableDebugAnnotation is set to true if the debug container is
 	// injected.
 	ProxyEnableDebugAnnotation = ProxyConfigAnnotationsPrefix + "/enable-debug-sidecar"
@@ -261,14 +254,6 @@ const (
 	// enabled, and what access log format is used.
 	ProxyAccessLogAnnotation = ProxyConfigAnnotationsPrefix + "/access-log"
 
-	// IdentityModeDefault is assigned to IdentityModeAnnotation to
-	// use the control plane's default identity scheme.
-	IdentityModeDefault = "default"
-
-	// IdentityModeDisabled is assigned to IdentityModeAnnotation to
-	// disable the proxy from participating in automatic identity.
-	IdentityModeDisabled = Disabled
-
 	// AllUnauthenticated allows all unathenticated connections.
 	AllUnauthenticated = "all-unauthenticated"
 
diff --git a/policy-controller/k8s/index/Cargo.toml b/policy-controller/k8s/index/Cargo.toml
index f61068004..a4b61bcd0 100644
--- a/policy-controller/k8s/index/Cargo.toml
+++ b/policy-controller/k8s/index/Cargo.toml
@@ -13,6 +13,6 @@ async-trait = "0.1"
 futures = { version = "0.3", default-features = false }
 linkerd-policy-controller-core = { path = "../../core" }
 linkerd-policy-controller-k8s-api = { path = "../api" }
-parking_lot = "0.11"
+parking_lot = "0.12"
 tokio = { version = "1", features = ["macros", "rt", "sync"] }
 tracing = "0.1"
diff --git a/proxy-identity/main.go b/proxy-identity/main.go
index 48a3bb48f..d44af4c38 100644
--- a/proxy-identity/main.go
+++ b/proxy-identity/main.go
@@ -21,7 +21,6 @@ import (
 
 const (
 	envDir          = "LINKERD2_PROXY_IDENTITY_DIR"
-	envDisabled     = "LINKERD2_PROXY_IDENTITY_DISABLED"
 	envLocalName    = "LINKERD2_PROXY_IDENTITY_LOCAL_NAME"
 	envTrustAnchors = "LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS"
 )
@@ -29,11 +28,6 @@ const (
 func main() {
 	defer runProxy()
 
-	if os.Getenv(envDisabled) != "" {
-		log.Debug("Identity disabled.")
-		return
-	}
-
 	dir := os.Getenv(envDir)
 	keyPath, csrPath, err := checkEndEntityDir(dir)
 	if err != nil {
diff --git a/web/app/package.json b/web/app/package.json
index a862eb66e..ead95472d 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -8,7 +8,7 @@
     "@fortawesome/fontawesome-svg-core": "1.2.36",
     "@fortawesome/free-regular-svg-icons": "5.15.4",
     "@fortawesome/free-solid-svg-icons": "5.15.4",
-    "@fortawesome/react-fontawesome": "0.1.16",
+    "@fortawesome/react-fontawesome": "0.1.17",
     "@lingui/core": "^3.13.2",
     "@lingui/macro": "3.13.2",
     "@lingui/react": "3.13.2",
@@ -54,12 +54,12 @@
     "babel-plugin-import": "^1.13.3",
     "babel-plugin-macros": "^3.1.0",
     "babel-plugin-transform-react-remove-prop-types": "0.4.24",
-    "chai": "4.3.5",
+    "chai": "4.3.6",
     "clean-webpack-plugin": "4.0.0",
     "css-loader": "^6.5.1",
     "enzyme": "3.11.0",
     "enzyme-adapter-react-16": "^1.15.6",
-    "eslint": "^8.7.0",
+    "eslint": "^8.8.0",
     "eslint-config-airbnb": "^19.0.4",
     "eslint-plugin-import": "^2.25.4",
     "eslint-plugin-jsx-a11y": "^6.5.1",
@@ -73,7 +73,7 @@
     "jest": "^27.4.7",
     "lodash-webpack-plugin": "^0.11.6",
     "react-test-renderer": "16.14.0",
-    "sinon": "12.0.1",
+    "sinon": "13.0.0",
     "sinon-stub-promise": "4.0.0",
     "style-loader": "^3.3.1",
     "url-loader": "^4.1.1",
diff --git a/web/app/yarn.lock b/web/app/yarn.lock
index cd78cae72..59453fb94 100644
--- a/web/app/yarn.lock
+++ b/web/app/yarn.lock
@@ -1085,12 +1085,12 @@
   dependencies:
     "@fortawesome/fontawesome-common-types" "^0.2.36"
 
-"@fortawesome/react-fontawesome@0.1.16":
-  version "0.1.16"
-  resolved "https://registry.yarnpkg.com/@fortawesome/react-fontawesome/-/react-fontawesome-0.1.16.tgz#ce7665490214e20f929368d6b65f68884a99276a"
-  integrity sha512-aLmzDwC9rEOAJv2UJdMns89VZR5Ry4IHu5dQQh24Z/lWKEm44lfQr1UNalZlkUaQN8d155tNh+CS7ntntj1VMA==
+"@fortawesome/react-fontawesome@0.1.17":
+  version "0.1.17"
+  resolved "https://registry.yarnpkg.com/@fortawesome/react-fontawesome/-/react-fontawesome-0.1.17.tgz#06fc06cb1a721e38e5b50b4a1cb851e9b9c77d7a"
+  integrity sha512-dX43Z5IvMaW7fwzU8farosYjKNGfRb2HB/DgjVBHeJZ/NSnuuaujPPx0YOdcAq+n3mqn70tyCde2HM1mqbhiuw==
   dependencies:
-    prop-types "^15.7.2"
+    prop-types "^15.8.1"
 
 "@humanwhocodes/config-array@^0.9.2":
   version "0.9.2"
@@ -1514,17 +1514,24 @@
   dependencies:
     "@sinonjs/commons" "^1.7.0"
 
-"@sinonjs/fake-timers@^8.0.1", "@sinonjs/fake-timers@^8.1.0":
+"@sinonjs/fake-timers@^8.0.1":
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/@sinonjs/fake-timers/-/fake-timers-8.1.0.tgz#3fdc2b6cb58935b21bfb8d1625eb1300484316e7"
   integrity sha512-OAPJUAtgeINhh/TAlUID4QTs53Njm7xzddaVlEs/SXwgtiD1tW22zAB/W1wdqfrpmikgaWQ9Fw6Ws+hsiRm5Vg==
   dependencies:
     "@sinonjs/commons" "^1.7.0"
 
-"@sinonjs/samsam@^6.0.2":
-  version "6.0.2"
-  resolved "https://registry.yarnpkg.com/@sinonjs/samsam/-/samsam-6.0.2.tgz#a0117d823260f282c04bff5f8704bdc2ac6910bb"
-  integrity sha512-jxPRPp9n93ci7b8hMfJOFDPRLFYadN6FSpeROFTR4UNF4i5b+EK6m4QXPO46BDhFgRy1JuS87zAnFOzCUwMJcQ==
+"@sinonjs/fake-timers@^9.0.0":
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/@sinonjs/fake-timers/-/fake-timers-9.0.0.tgz#6854809cd058c6e25b3da2fa063153eaea4ffc72"
+  integrity sha512-+shXA2X7KNP7H7qNbQTJ3SA+NQc0pZDSBrdvFSRwF8sAo/ohw+ZQFD8Moc+gnz51+1eRXtEQBpKWPiQ4jsRC/w==
+  dependencies:
+    "@sinonjs/commons" "^1.7.0"
+
+"@sinonjs/samsam@^6.1.1":
+  version "6.1.1"
+  resolved "https://registry.yarnpkg.com/@sinonjs/samsam/-/samsam-6.1.1.tgz#627f7f4cbdb56e6419fa2c1a3e4751ce4f6a00b1"
+  integrity sha512-cZ7rKJTLiE7u7Wi/v9Hc2fs3Ucc3jrWeMgPHbbTCeVAB2S0wOBbYlkJVeNSL04i7fdhT8wIbDq1zhC/PXTD2SA==
   dependencies:
     "@sinonjs/commons" "^1.6.0"
     lodash.get "^4.4.2"
@@ -2579,16 +2586,16 @@ caniuse-lite@^1.0.30001286:
   resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001299.tgz#d753bf6444ed401eb503cbbe17aa3e1451b5a68c"
   integrity sha512-iujN4+x7QzqA2NCSrS5VUy+4gLmRd4xv6vbBBsmfVqTx8bLAD8097euLqQgKxSVLvxjSDcvF1T/i9ocgnUFexw==
 
-chai@4.3.5:
-  version "4.3.5"
-  resolved "https://registry.yarnpkg.com/chai/-/chai-4.3.5.tgz#784cf398a30cd45b8980181ba1a8c866c225b5df"
-  integrity sha512-0gKhNDL29PUlmwz1CG42p/OaBf1v0YD3oH4//YMS1niT7rLH9tC+lqTgk+SvdbhMLd7ToTtxA61orNBmpSO/DA==
+chai@4.3.6:
+  version "4.3.6"
+  resolved "https://registry.yarnpkg.com/chai/-/chai-4.3.6.tgz#ffe4ba2d9fa9d6680cc0b370adae709ec9011e9c"
+  integrity sha512-bbcp3YfHCUzMOvKqsztczerVgBKSsEijCySNlHHbX3VG1nskvqjz5Rfso1gGwD6w6oOV3eI60pKuMOV5MV7p3Q==
   dependencies:
     assertion-error "^1.1.0"
     check-error "^1.0.2"
     deep-eql "^3.0.1"
     get-func-name "^2.0.0"
-    loupe "^2.3.0"
+    loupe "^2.3.1"
     pathval "^1.1.1"
     type-detect "^4.0.5"
 
@@ -3750,10 +3757,10 @@ eslint-webpack-plugin@^3.1.1:
     normalize-path "^3.0.0"
     schema-utils "^3.1.1"
 
-eslint@^8.7.0:
-  version "8.7.0"
-  resolved "https://registry.yarnpkg.com/eslint/-/eslint-8.7.0.tgz#22e036842ee5b7cf87b03fe237731675b4d3633c"
-  integrity sha512-ifHYzkBGrzS2iDU7KjhCAVMGCvF6M3Xfs8X8b37cgrUlDt6bWRTpRh6T/gtSXv1HJ/BUGgmjvNvOEGu85Iif7w==
+eslint@^8.8.0:
+  version "8.8.0"
+  resolved "https://registry.yarnpkg.com/eslint/-/eslint-8.8.0.tgz#9762b49abad0cb4952539ffdb0a046392e571a2d"
+  integrity sha512-H3KXAzQGBH1plhYS3okDix2ZthuYJlQQEGE5k0IKuEqUSiyu4AmxxlJ2MtTYeJ3xB4jDhcYCwGOg2TXYdnDXlQ==
   dependencies:
     "@eslint/eslintrc" "^1.0.5"
     "@humanwhocodes/config-array" "^0.9.2"
@@ -5702,13 +5709,12 @@ loose-envify@^1.1.0, loose-envify@^1.2.0, loose-envify@^1.3.1, loose-envify@^1.4
   dependencies:
     js-tokens "^3.0.0 || ^4.0.0"
 
-loupe@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/loupe/-/loupe-2.3.0.tgz#cfae54d12853592e0ec455af490fd6867e26875e"
-  integrity sha512-b6TVXtF01VErh8IxN/MfdiWLQmttrenN98PPGS01kym8kGycJ9tqBXD6D+4sNEDhgE83+H0Mk1cVSl0mD1nNSg==
+loupe@^2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/loupe/-/loupe-2.3.1.tgz#a2e1192c9f452e4e85089766da10ac8288383947"
+  integrity sha512-EN1D3jyVmaX4tnajVlfbREU4axL647hLec1h/PXAb8CPDMJiYitcWF2UeLVNttRqaIqQs4x+mRvXf+d+TlDrCA==
   dependencies:
     get-func-name "^2.0.0"
-    type-detect "^4.0.8"
 
 lower-case@^2.0.2:
   version "2.0.2"
@@ -6566,7 +6572,7 @@ prop-types-exact@^1.2.0:
     object.assign "^4.1.0"
     reflect.ownkeys "^0.2.0"
 
-prop-types@15.8.1, prop-types@^15.6.2, prop-types@^15.7.2:
+prop-types@15.8.1, prop-types@^15.6.2, prop-types@^15.7.2, prop-types@^15.8.1:
   version "15.8.1"
   resolved "https://registry.yarnpkg.com/prop-types/-/prop-types-15.8.1.tgz#67d87bf1a694f48435cf332c24af10214a3140b5"
   integrity sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==
@@ -7209,14 +7215,14 @@ sinon-stub-promise@4.0.0:
   resolved "https://registry.yarnpkg.com/sinon-stub-promise/-/sinon-stub-promise-4.0.0.tgz#6d498ba1198557cd01e3466af92dc7df725192c2"
   integrity sha1-bUmLoRmFV80B40Zq+S3H33JRksI=
 
-sinon@12.0.1:
-  version "12.0.1"
-  resolved "https://registry.yarnpkg.com/sinon/-/sinon-12.0.1.tgz#331eef87298752e1b88a662b699f98e403c859e9"
-  integrity sha512-iGu29Xhym33ydkAT+aNQFBINakjq69kKO6ByPvTsm3yyIACfyQttRTP03aBP/I8GfhFmLzrnKwNNkr0ORb1udg==
+sinon@13.0.0:
+  version "13.0.0"
+  resolved "https://registry.yarnpkg.com/sinon/-/sinon-13.0.0.tgz#3701f90204a1baa7457a3da70c9adcf335e92056"
+  integrity sha512-3tjMDB/tY04b06Bnb4aMKQfNrau2C9HET+R4HVWfv2KegDVLGg4wnBqjVepvxR7S7R1GTwDZzEv52tpFipt6yA==
   dependencies:
     "@sinonjs/commons" "^1.8.3"
-    "@sinonjs/fake-timers" "^8.1.0"
-    "@sinonjs/samsam" "^6.0.2"
+    "@sinonjs/fake-timers" "^9.0.0"
+    "@sinonjs/samsam" "^6.1.1"
     diff "^5.0.0"
     nise "^5.1.0"
     supports-color "^7.2.0"


Test patch:
diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
index 93fde9112..997d53c85 100644
--- a/cli/cmd/inject_test.go
+++ b/cli/cmd/inject_test.go
@@ -664,7 +664,6 @@ func TestProxyConfigurationAnnotations(t *testing.T) {
 	values.Proxy.UID = 999
 	values.Proxy.LogLevel = "debug"
 	values.Proxy.LogFormat = "cool"
-	values.Proxy.DisableIdentity = true
 	values.Proxy.EnableExternalProfiles = true
 	values.Proxy.Resources.CPU.Request = "10m"
 	values.Proxy.Resources.CPU.Limit = "100m"
@@ -684,7 +683,6 @@ func TestProxyConfigurationAnnotations(t *testing.T) {
 		k8s.ProxyUIDAnnotation:                 "999",
 		k8s.ProxyLogLevelAnnotation:            "debug",
 		k8s.ProxyLogFormatAnnotation:           "cool",
-		k8s.ProxyDisableIdentityAnnotation:     "true",
 
 		k8s.ProxyEnableExternalProfilesAnnotation: "true",
 		k8s.ProxyCPURequestAnnotation:             "10m",
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index 07682fce5..cce8296ee 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -10,7 +10,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
       labels:
         app: nginx
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 373c53007..24d1992b6 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -10,7 +10,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
       labels:
         app: redis
@@ -208,7 +207,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
       labels:
         app: nginx
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index e2204ccf6..53c68a141 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -10,7 +10,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
       labels:
         app: redis
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 059cb7f43..1db208bdd 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -14,7 +14,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
         prometheus.io/format: prometheus
         prometheus.io/path: /stats
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 85e00b192..685aeeb90 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
@@ -221,7 +220,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
@@ -430,7 +428,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
@@ -639,7 +636,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index 2237c7ed5..fa65c87be 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
index dc911f36c..6f12e9897 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
@@ -13,7 +13,6 @@ spec:
       annotations:
         config.linkerd.io/access-log: apache
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
index fb33af343..be306c3f0 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: testinjectversion
       labels:
         app: nginx
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index 9c21c80e6..56afa29de 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 0236bfecc..6e327f06b 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -20,7 +20,6 @@ spec:
         config.linkerd.io/skip-inbound-ports: 7777,8888
         config.linkerd.io/skip-outbound-ports: "9999"
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: override
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index 045f5cba6..1aea4d11e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
@@ -221,7 +220,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index a9afff3a4..1c5b7c050 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -13,7 +13,6 @@ spec:
       annotations:
         config.linkerd.io/enable-debug-sidecar: "true"
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 7e5b46593..9eb847c60 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 9bb5cb1cc..8ee283515 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
index 31c4aba03..023100832 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
index 5fca1b398..4b2b97b2a 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
@@ -13,7 +13,6 @@ spec:
       annotations:
         config.linkerd.io/opaque-ports: 3000,5000-6000,mysql
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index 2cb072f74..006bea51b 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -13,7 +13,6 @@ spec:
       annotations:
         config.linkerd.io/admin-port: "1234"
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index 7822ff8a5..7a8acdb7a 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -14,7 +14,6 @@ spec:
         config.linkerd.io/skip-inbound-ports: 22,8100-8102
         config.linkerd.io/skip-outbound-ports: "5432"
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index 4e9894e8c..a1de3f7fa 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index 587ecf1cb..30e86c7c7 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -14,7 +14,6 @@ items:
       metadata:
         annotations:
           linkerd.io/created-by: linkerd/cli dev-undefined
-          linkerd.io/identity-mode: default
           linkerd.io/proxy-version: test-inject-proxy-version
         labels:
           app: web-svc
@@ -222,7 +221,6 @@ items:
       metadata:
         annotations:
           linkerd.io/created-by: linkerd/cli dev-undefined
-          linkerd.io/identity-mode: default
           linkerd.io/proxy-version: test-inject-proxy-version
         labels:
           app: emoji-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index 08e9a4d17..b73cd6bda 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -14,7 +14,6 @@ items:
       metadata:
         annotations:
           linkerd.io/created-by: linkerd/cli dev-undefined
-          linkerd.io/identity-mode: default
           linkerd.io/proxy-version: test-inject-proxy-version
         labels:
           app: web-svc
@@ -222,7 +221,6 @@ items:
       metadata:
         annotations:
           linkerd.io/created-by: linkerd/cli dev-undefined
-          linkerd.io/identity-mode: default
           linkerd.io/proxy-version: test-inject-proxy-version
         labels:
           app: emoji-svc
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index f92dcf0db..0e6e1fa1e 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -3,7 +3,6 @@ kind: Pod
 metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
-    linkerd.io/identity-mode: default
     linkerd.io/proxy-version: test-inject-proxy-version
   labels:
     app: vote-bot
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
index a72f1d06e..4d69779c5 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
@@ -3,7 +3,6 @@ kind: Pod
 metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
-    linkerd.io/identity-mode: default
     linkerd.io/inject: ingress
     linkerd.io/proxy-version: test-inject-proxy-version
   labels:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index 0fd90939d..4572d06a2 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -5,7 +5,6 @@ metadata:
     config.linkerd.io/skip-inbound-ports: 22,8100-8102
     config.linkerd.io/skip-outbound-ports: "5432"
     linkerd.io/created-by: linkerd/cli dev-undefined
-    linkerd.io/identity-mode: default
     linkerd.io/proxy-version: test-inject-proxy-version
   labels:
     app: vote-bot
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index b9c116120..576ee94b2 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -7,7 +7,6 @@ metadata:
     config.linkerd.io/proxy-memory-limit: 150Mi
     config.linkerd.io/proxy-memory-request: 100Mi
     linkerd.io/created-by: linkerd/cli dev-undefined
-    linkerd.io/identity-mode: default
     linkerd.io/proxy-version: test-inject-proxy-version
   labels:
     app: vote-bot
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index d147996e7..89bafd76f 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -13,7 +13,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         app: web-svc
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 24236c953..afbaa81e0 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -8,7 +8,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: testinjectversion
       labels:
         app: get-test
@@ -219,7 +218,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: testinjectversion
       labels:
         app: get-test
diff --git a/cli/cmd/testdata/inject_tap_deployment.input.yml b/cli/cmd/testdata/inject_tap_deployment.input.yml
index 8143cc5c8..fcbd3086f 100644
--- a/cli/cmd/testdata/inject_tap_deployment.input.yml
+++ b/cli/cmd/testdata/inject_tap_deployment.input.yml
@@ -30,7 +30,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli git-a94122bf
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: git-a94122bf
       creationTimestamp: null
       labels:
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index b90f3dbb6..225e51b3c 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -29,7 +29,6 @@ spec:
       annotations:
         config.linkerd.io/enable-debug-sidecar: "true"
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-inject-proxy-version
       labels:
         linkerd.io/control-plane-component: tap
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 2b95167c5..38ada41cd 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1735,7 +1733,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2094,7 +2091,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index e74b1aaf9..d7e5994c0 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 84e0e2298..4f3798462 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: my.custom.registry/linkerd-io/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index e74b1aaf9..d7e5994c0 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 21c8502b3..1036b4197 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index 891b8b8ee..a267c1330 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1725,7 +1723,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2074,7 +2071,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 09e43e211..94fe02fa7 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -1237,7 +1237,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1449,7 +1448,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1839,7 +1837,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2237,7 +2234,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index aac99c693..77f14dc75 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -1237,7 +1237,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1449,7 +1448,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1839,7 +1837,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2237,7 +2234,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 166a4db04..b90bbc9b1 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -1141,7 +1141,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1325,7 +1324,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1665,7 +1663,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1973,7 +1970,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index bb81d9719..a7c8d906c 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -476,7 +476,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -654,7 +653,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -997,7 +995,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1360,7 +1357,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 0f68011c4..fba742cab 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -503,7 +503,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -709,7 +708,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1102,7 +1100,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1505,7 +1502,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index c09e7d23d..a5ee342fd 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -507,7 +507,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -713,7 +712,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         asda: fasda
         bingo: bongo
@@ -1110,7 +1108,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         asda: fasda
         bingo: bongo
@@ -1521,7 +1518,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         asda: fasda
         bingo: bongo
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 96a2f3a62..7dcacf8b8 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -503,7 +503,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -709,7 +708,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1102,7 +1100,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1505,7 +1502,6 @@ spec:
       annotations:
         linkerd.io/helm-release-version: "0"
         linkerd.io/created-by: linkerd/helm linkerd-version
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: test-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 1507a2ade..2eabf742e 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1697,7 +1695,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2018,7 +2015,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 74e91791b..9d397d0a4 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -1207,7 +1207,6 @@ data:
       await: false
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: ProxyImageName
@@ -1391,7 +1390,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: CliVersion
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: ProxyVersion
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: CliVersion
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: ProxyVersion
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2102,7 +2099,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: CliVersion
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: ProxyVersion
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index f0267a6c8..c7529bcd2 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 905d71acd..94bb784c1 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -1210,7 +1210,6 @@ data:
       await: true
       capabilities: null
       defaultInboundPolicy: ""
-      disableIdentity: false
       enableExternalProfiles: false
       image:
         name: cr.l5d.io/linkerd/proxy
@@ -1394,7 +1393,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -1734,7 +1732,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
       labels:
@@ -2092,7 +2089,6 @@ spec:
     metadata:
       annotations:
         linkerd.io/created-by: linkerd/cli dev-undefined
-        linkerd.io/identity-mode: default
         linkerd.io/proxy-version: install-proxy-version
         config.linkerd.io/opaque-ports: "8443"
         config.linkerd.io/default-inbound-policy: "all-unauthenticated"
diff --git a/cli/cmd/upgrade_test.go b/cli/cmd/upgrade_test.go
index a4f337e84..e6e8b9590 100644
--- a/cli/cmd/upgrade_test.go
+++ b/cli/cmd/upgrade_test.go
@@ -520,7 +520,6 @@ kind: Pod
 metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli some-version
-    linkerd.io/identity-mode: default
     linkerd.io/proxy-version: some-version
   labels:
     linkerd.io/control-plane-ns: linkerd
diff --git a/controller/api/destination/endpoint_translator_test.go b/controller/api/destination/endpoint_translator_test.go
index e0a76345f..00365ac13 100644
--- a/controller/api/destination/endpoint_translator_test.go
+++ b/controller/api/destination/endpoint_translator_test.go
@@ -20,16 +20,13 @@ import (
 )
 
 var (
-	normalPod = watcher.Address{
+	pod1 = watcher.Address{
 		IP:   "1.1.1.1",
 		Port: 1,
 		Pod: &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "pod1",
 				Namespace: "ns",
-				Annotations: map[string]string{
-					k8s.IdentityModeAnnotation: k8s.IdentityModeDefault,
-				},
 				Labels: map[string]string{
 					k8s.ControllerNSLabel:    "linkerd",
 					k8s.ProxyDeploymentLabel: "deployment-name",
@@ -43,16 +40,13 @@ var (
 		OwnerName: "rc-name",
 	}
 
-	tlsOptionalPod = watcher.Address{
+	pod2 = watcher.Address{
 		IP:   "1.1.1.2",
 		Port: 2,
 		Pod: &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "pod2",
 				Namespace: "ns",
-				Annotations: map[string]string{
-					k8s.IdentityModeAnnotation: "optional",
-				},
 				Labels: map[string]string{
 					k8s.ControllerNSLabel:    "linkerd",
 					k8s.ProxyDeploymentLabel: "deployment-name",
@@ -61,34 +55,13 @@ var (
 		},
 	}
 
-	otherMeshPod = watcher.Address{
+	pod3 = watcher.Address{
 		IP:   "1.1.1.3",
 		Port: 3,
 		Pod: &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "pod3",
 				Namespace: "ns",
-				Annotations: map[string]string{
-					k8s.IdentityModeAnnotation: k8s.IdentityModeDefault,
-				},
-				Labels: map[string]string{
-					k8s.ControllerNSLabel:    "other-linkerd-namespace",
-					k8s.ProxyDeploymentLabel: "deployment-name",
-				},
-			},
-		},
-	}
-
-	tlsDisabledPod = watcher.Address{
-		IP:   "1.1.1.4",
-		Port: 4,
-		Pod: &corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "pod4",
-				Namespace: "ns",
-				Annotations: map[string]string{
-					k8s.IdentityModeAnnotation: k8s.IdentityModeDisabled,
-				},
 				Labels: map[string]string{
 					k8s.ControllerNSLabel:    "linkerd",
 					k8s.ProxyDeploymentLabel: "deployment-name",
@@ -97,18 +70,18 @@ var (
 		},
 	}
 
-	remoteGatewayWithNoTLS = watcher.Address{
+	remoteGateway1 = watcher.Address{
 		IP:   "1.1.1.1",
 		Port: 1,
 	}
 
-	remoteGatewayWithTLS = watcher.Address{
+	remoteGateway2 = watcher.Address{
 		IP:       "1.1.1.2",
 		Port:     2,
 		Identity: "some-identity",
 	}
 
-	remoteGatewayWithTLSAndAuthOverride = watcher.Address{
+	remoteGatewayAuthOverride = watcher.Address{
 		IP:                "1.1.1.2",
 		Port:              2,
 		Identity:          "some-identity",
@@ -174,8 +147,8 @@ func TestEndpointTranslatorForRemoteGateways(t *testing.T) {
 	t.Run("Sends one update for add and another for remove", func(t *testing.T) {
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForServices(remoteGatewayWithNoTLS, remoteGatewayWithTLS))
-		translator.Remove(mkAddressSetForServices(remoteGatewayWithTLS))
+		translator.Add(mkAddressSetForServices(remoteGateway1, remoteGateway2))
+		translator.Remove(mkAddressSetForServices(remoteGateway2))
 
 		expectedNumUpdates := 2
 		actualNumUpdates := len(mockGetServer.updatesReceived)
@@ -197,7 +170,7 @@ func TestEndpointTranslatorForRemoteGateways(t *testing.T) {
 
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForServices(remoteGatewayWithTLS))
+		translator.Add(mkAddressSetForServices(remoteGateway2))
 
 		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
 		if len(addrs) != 1 {
@@ -232,7 +205,7 @@ func TestEndpointTranslatorForRemoteGateways(t *testing.T) {
 
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForServices(remoteGatewayWithTLSAndAuthOverride))
+		translator.Add(mkAddressSetForServices(remoteGatewayAuthOverride))
 
 		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
 		if len(addrs) != 1 {
@@ -258,7 +231,7 @@ func TestEndpointTranslatorForRemoteGateways(t *testing.T) {
 	t.Run("Does not send TlsIdentity when not present", func(t *testing.T) {
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForServices(remoteGatewayWithNoTLS))
+		translator.Add(mkAddressSetForServices(remoteGateway1))
 
 		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
 		if len(addrs) != 1 {
@@ -279,8 +252,8 @@ func TestEndpointTranslatorForPods(t *testing.T) {
 	t.Run("Sends one update for add and another for remove", func(t *testing.T) {
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForPods(normalPod, tlsOptionalPod))
-		translator.Remove(mkAddressSetForPods(tlsOptionalPod))
+		translator.Add(mkAddressSetForPods(pod1, pod2))
+		translator.Remove(mkAddressSetForPods(pod2))
 
 		expectedNumUpdates := 2
 		actualNumUpdates := len(mockGetServer.updatesReceived)
@@ -292,8 +265,8 @@ func TestEndpointTranslatorForPods(t *testing.T) {
 	t.Run("Sends addresses as removed or added", func(t *testing.T) {
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForPods(normalPod, tlsOptionalPod, tlsDisabledPod))
-		translator.Remove(mkAddressSetForPods(tlsDisabledPod))
+		translator.Add(mkAddressSetForPods(pod1, pod2, pod3))
+		translator.Remove(mkAddressSetForPods(pod3))
 
 		addressesAdded := mockGetServer.updatesReceived[0].GetAdd().Addrs
 		actualNumberOfAdded := len(addressesAdded)
@@ -312,15 +285,15 @@ func TestEndpointTranslatorForPods(t *testing.T) {
 		sort.Slice(addressesAdded, func(i, j int) bool {
 			return addressesAdded[i].GetAddr().Port < addressesAdded[j].GetAddr().Port
 		})
-		checkAddressAndWeight(t, addressesAdded[0], normalPod)
-		checkAddressAndWeight(t, addressesAdded[1], tlsOptionalPod)
-		checkAddress(t, addressesRemoved[0], tlsDisabledPod)
+		checkAddressAndWeight(t, addressesAdded[0], pod1)
+		checkAddressAndWeight(t, addressesAdded[1], pod2)
+		checkAddress(t, addressesRemoved[0], pod3)
 	})
 
 	t.Run("Sends metric labels with added addresses", func(t *testing.T) {
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForPods(normalPod))
+		translator.Add(mkAddressSetForPods(pod1))
 
 		actualGlobalMetricLabels := mockGetServer.updatesReceived[0].GetAdd().MetricLabels
 		expectedGlobalMetricLabels := map[string]string{"namespace": "service-ns", "service": "service-name"}
@@ -347,7 +320,7 @@ func TestEndpointTranslatorForPods(t *testing.T) {
 
 		mockGetServer, translator := makeEndpointTranslator(t)
 
-		translator.Add(mkAddressSetForPods(normalPod))
+		translator.Add(mkAddressSetForPods(pod1))
 
 		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
 		if len(addrs) != 1 {
@@ -359,51 +332,6 @@ func TestEndpointTranslatorForPods(t *testing.T) {
 			t.Fatalf("Expected TlsIdentity to be [%v] but was [%v]", expectedTLSIdentity, actualTLSIdentity)
 		}
 	})
-
-	t.Run("Does not send TlsIdentity for non-default identity-modes", func(t *testing.T) {
-		mockGetServer, translator := makeEndpointTranslator(t)
-
-		translator.Add(mkAddressSetForPods(tlsOptionalPod))
-
-		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
-		if len(addrs) != 1 {
-			t.Fatalf("Expected [1] address returned, got %v", addrs)
-		}
-
-		if addrs[0].TlsIdentity != nil {
-			t.Fatalf("Expected no TlsIdentity to be sent, but got [%v]", addrs[0].TlsIdentity)
-		}
-	})
-
-	t.Run("Does not send TlsIdentity for other meshes", func(t *testing.T) {
-		mockGetServer, translator := makeEndpointTranslator(t)
-
-		translator.Add(mkAddressSetForPods(otherMeshPod))
-
-		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
-		if len(addrs) != 1 {
-			t.Fatalf("Expected [1] address returned, got %v", addrs)
-		}
-
-		if addrs[0].TlsIdentity != nil {
-			t.Fatalf("Expected no TlsIdentity to be sent, but got [%v]", addrs[0].TlsIdentity)
-		}
-	})
-
-	t.Run("Does not send TlsIdentity when not enabled", func(t *testing.T) {
-		mockGetServer, translator := makeEndpointTranslator(t)
-
-		translator.Add(mkAddressSetForPods(tlsDisabledPod))
-
-		addrs := mockGetServer.updatesReceived[0].GetAdd().GetAddrs()
-		if len(addrs) != 1 {
-			t.Fatalf("Expected [1] address returned, got %v", addrs)
-		}
-
-		if addrs[0].TlsIdentity != nil {
-			t.Fatalf("Expected no TlsIdentity to be sent, but got [%v]", addrs[0].TlsIdentity)
-		}
-	})
 }
 
 func TestEndpointTranslatorForZonedAddresses(t *testing.T) {
diff --git a/controller/proxy-injector/webhook_test.go b/controller/proxy-injector/webhook_test.go
index e4aa33703..651dc9c41 100644
--- a/controller/proxy-injector/webhook_test.go
+++ b/controller/proxy-injector/webhook_test.go
@@ -62,7 +62,7 @@ func confNsWithConfigAnnotations() *inject.ResourceConfig {
 }
 func TestGetPodPatch(t *testing.T) {
 
-	values.Proxy.DisableIdentity = true
+	values.IdentityTrustAnchorsPEM = "IdentityTrustAnchorsPEM"
 
 	factory := fake.NewFactory(filepath.Join("fake", "data"))
 	nsEnabled, err := factory.Namespace("namespace-inject-enabled.yaml")
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 0367bb6bb..ef4c97d5d 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2226,7 +2226,6 @@ data:
     proxy:
       capabilities: null
       component: linkerd-controller
-      disableIdentity: false
       disableTap: false
       enableExternalProfiles: false
       image:
@@ -2382,7 +2381,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
         image:
diff --git a/pkg/inject/inject_test.go b/pkg/inject/inject_test.go
index 1ff78fccd..9c83d3eb8 100644
--- a/pkg/inject/inject_test.go
+++ b/pkg/inject/inject_test.go
@@ -40,7 +40,6 @@ func TestGetOverriddenValues(t *testing.T) {
 				Template: corev1.PodTemplateSpec{
 					ObjectMeta: metav1.ObjectMeta{
 						Annotations: map[string]string{
-							k8s.ProxyDisableIdentityAnnotation:               "true",
 							k8s.ProxyImageAnnotation:                         "cr.l5d.io/linkerd/proxy",
 							k8s.ProxyImagePullPolicyAnnotation:               pullPolicy,
 							k8s.ProxyInitImageAnnotation:                     "cr.l5d.io/linkerd/proxy-init",
@@ -79,7 +78,6 @@ func TestGetOverriddenValues(t *testing.T) {
 				values, _ := l5dcharts.NewValues()
 
 				values.Proxy.Cores = 2
-				values.Proxy.DisableIdentity = true
 				values.Proxy.Image.Name = "cr.l5d.io/linkerd/proxy"
 				values.Proxy.Image.PullPolicy = pullPolicy
 				values.Proxy.Image.Version = proxyVersionOverride
@@ -136,7 +134,6 @@ func TestGetOverriddenValues(t *testing.T) {
 		},
 		{id: "use namespace overrides",
 			nsAnnotations: map[string]string{
-				k8s.ProxyDisableIdentityAnnotation:        "true",
 				k8s.ProxyImageAnnotation:                  "cr.l5d.io/linkerd/proxy",
 				k8s.ProxyImagePullPolicyAnnotation:        pullPolicy,
 				k8s.ProxyInitImageAnnotation:              "cr.l5d.io/linkerd/proxy-init",
@@ -172,7 +169,6 @@ func TestGetOverriddenValues(t *testing.T) {
 				values, _ := l5dcharts.NewValues()
 
 				values.Proxy.Cores = 2
-				values.Proxy.DisableIdentity = true
 				values.Proxy.Image.Name = "cr.l5d.io/linkerd/proxy"
 				values.Proxy.Image.PullPolicy = pullPolicy
 				values.Proxy.Image.Version = proxyVersionOverride
diff --git a/test/integration/inject/inject_test.go b/test/integration/inject/inject_test.go
index e3d8a12cc..1a38ed16c 100644
--- a/test/integration/inject/inject_test.go
+++ b/test/integration/inject/inject_test.go
@@ -59,7 +59,7 @@ func TestInjectManualParams(t *testing.T) {
 	}
 
 	injectionValidator := testutil.InjectValidator{
-		DisableIdentity:        true,
+		NoInitContainer:        TestHelper.CNI(),
 		Version:                "proxy-version",
 		Image:                  reg + "/proxy-image",
 		InitImage:              reg + "/init-image",
@@ -83,8 +83,6 @@ func TestInjectManualParams(t *testing.T) {
 	// TODO: test config.linkerd.io/proxy-version
 	cmd := append([]string{"inject",
 		"--manual",
-		"--linkerd-namespace=fake-ns",
-		"--ignore-cluster",
 	}, flags...)
 
 	cmd = append(cmd, "testdata/inject_test.yaml")
diff --git a/test/integration/install_test.go b/test/integration/install_test.go
index 964713870..715d1894f 100644
--- a/test/integration/install_test.go
+++ b/test/integration/install_test.go
@@ -57,28 +57,6 @@ var (
 		{Namespace: "linkerd-multicluster", Name: "linkerd-gateway"},
 	}
 
-	injectionCases = []struct {
-		ns          string
-		annotations map[string]string
-		injectArgs  []string
-	}{
-		{
-			ns: "smoke-test",
-			annotations: map[string]string{
-				k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
-			},
-			injectArgs: nil,
-		},
-		{
-			ns:         "smoke-test-manual",
-			injectArgs: []string{"--manual"},
-		},
-		{
-			ns:         "smoke-test-ann",
-			injectArgs: []string{},
-		},
-	}
-
 	//skippedInboundPorts lists some ports to be marked as skipped, which will
 	// be verified in test/integration/inject
 	skippedInboundPorts       = "1234,5678"
@@ -1115,124 +1093,6 @@ func TestDashboard(t *testing.T) {
 	}
 }
 
-func TestInject(t *testing.T) {
-	resources, err := testutil.ReadFile("testdata/smoke_test.yaml")
-	if err != nil {
-		testutil.AnnotatedFatalf(t, "failed to read smoke test file",
-			"failed to read smoke test file: %s", err)
-	}
-
-	ctx := context.Background()
-	for _, tc := range injectionCases {
-		tc := tc // pin
-		t.Run(tc.ns, func(t *testing.T) {
-			var out string
-
-			prefixedNs := TestHelper.GetTestNamespace(tc.ns)
-
-			err := TestHelper.CreateDataPlaneNamespaceIfNotExists(ctx, prefixedNs, tc.annotations)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, fmt.Sprintf("failed to create %s namespace", prefixedNs),
-					"failed to create %s namespace: %s", prefixedNs, err)
-			}
-
-			if tc.injectArgs != nil {
-				cmd := []string{"inject"}
-				cmd = append(cmd, tc.injectArgs...)
-				cmd = append(cmd, "testdata/smoke_test.yaml")
-
-				var injectReport string
-				out, injectReport, err = TestHelper.PipeToLinkerdRun("", cmd...)
-				if err != nil {
-					testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
-						"'linkerd inject' command failed: %s\n%s", err, out)
-				}
-
-				err = TestHelper.ValidateOutput(injectReport, "inject.report.golden")
-				if err != nil {
-					testutil.AnnotatedFatalf(t, "received unexpected output",
-						"received unexpected output\n%s", err.Error())
-				}
-			} else {
-				out = resources
-			}
-
-			out, err = TestHelper.KubectlApply(out, prefixedNs)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, "'kubectl apply' command failed",
-					"'kubectl apply' command failed\n%s", out)
-			}
-
-			for _, deploy := range []string{"smoke-test-terminus", "smoke-test-gateway"} {
-				if err := TestHelper.CheckPods(ctx, prefixedNs, deploy, 1); err != nil {
-					if rce, ok := err.(*testutil.RestartCountError); ok {
-						testutil.AnnotatedWarn(t, "CheckPods timed-out", rce)
-					} else {
-						testutil.AnnotatedFatal(t, "CheckPods timed-out", err)
-					}
-				}
-			}
-
-			url, err := TestHelper.URLFor(ctx, prefixedNs, "smoke-test-gateway", 8080)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, "failed to get URL",
-					"failed to get URL: %s", err)
-			}
-
-			output, err := TestHelper.HTTPGetURL(url)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, "unexpected error",
-					"unexpected error: %v %s", err, output)
-			}
-
-			expectedStringInPayload := "\"payload\":\"BANANA\""
-			if !strings.Contains(output, expectedStringInPayload) {
-				testutil.AnnotatedFatalf(t, "application response doesn't contain the expected response",
-					"expected application response to contain string [%s], but it was [%s]",
-					expectedStringInPayload, output)
-			}
-		})
-	}
-}
-
-func TestServiceProfileDeploy(t *testing.T) {
-	bbProto, err := TestHelper.HTTPGetURL("https://raw.githubusercontent.com/BuoyantIO/bb/v0.0.5/api.proto")
-	if err != nil {
-		testutil.AnnotatedFatalf(t, "unexpected error",
-			"unexpected error: %v %s", err, bbProto)
-	}
-
-	for _, tc := range injectionCases {
-		tc := tc // pin
-		t.Run(tc.ns, func(t *testing.T) {
-			prefixedNs := TestHelper.GetTestNamespace(tc.ns)
-
-			cmd := []string{"profile", "-n", prefixedNs, "--proto", "-", "smoke-test-terminus-svc"}
-			bbSP, stderr, err := TestHelper.PipeToLinkerdRun(bbProto, cmd...)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, "unexpected error",
-					"unexpected error: %v %s", err, stderr)
-			}
-
-			out, err := TestHelper.KubectlApply(bbSP, prefixedNs)
-			if err != nil {
-				testutil.AnnotatedFatalf(t, "'kubectl apply' command failed",
-					"'kubectl apply' command failed: %s\n%s", err, out)
-			}
-		})
-	}
-}
-
-func TestCheckProxy(t *testing.T) {
-	for _, tc := range injectionCases {
-		tc := tc // pin
-		t.Run(tc.ns, func(t *testing.T) {
-			prefixedNs := TestHelper.GetTestNamespace(tc.ns)
-			testCheckCommand(t, "proxy", TestHelper.GetVersion(), prefixedNs, "")
-		})
-	}
-}
-
 func TestRestarts(t *testing.T) {
 	expectedDeployments := testutil.LinkerdDeployReplicasEdge
 	if !TestHelper.ExternalPrometheus() {
@@ -1249,20 +1109,6 @@ func TestRestarts(t *testing.T) {
 	}
 }
 
-// TestCleanUp deletes the resources used in the above tests
-func TestCleanUp(t *testing.T) {
-	ctx := context.Background()
-	for _, tc := range injectionCases {
-		tc := tc // pin
-		t.Run(tc.ns, func(t *testing.T) {
-			prefixedNs := TestHelper.GetTestNamespace(tc.ns)
-			if err := TestHelper.DeleteNamespaceIfExists(ctx, prefixedNs); err != nil {
-				testutil.AnnotatedFatal(t, "Deleting namespace failed", err)
-			}
-		})
-	}
-}
-
 func TestCheckMulticluster(t *testing.T) {
 	if TestHelper.GetMulticlusterHelmReleaseName() != "" || TestHelper.Multicluster() {
 		cmd := []string{"multicluster", "check", "--wait=60m"}
diff --git a/test/integration/smoke/install_smoke_test.go b/test/integration/smoke/install_smoke_test.go
new file mode 100644
index 000000000..d31cb764c
--- /dev/null
+++ b/test/integration/smoke/install_smoke_test.go
@@ -0,0 +1,146 @@
+package smoke
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"html/template"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/linkerd/linkerd2/pkg/healthcheck"
+	"github.com/linkerd/linkerd2/pkg/version"
+	"github.com/linkerd/linkerd2/testutil"
+)
+
+//////////////////////
+///   TEST SETUP   ///
+//////////////////////
+
+var (
+	TestHelper *testutil.TestHelper
+)
+
+func TestMain(m *testing.M) {
+	TestHelper = testutil.NewTestHelper()
+	if TestHelper.CNI() {
+		os.Exit(0)
+	}
+	os.Exit(m.Run())
+}
+
+//////////////////////
+/// TEST EXECUTION ///
+//////////////////////
+
+func TestSmoke(t *testing.T) {
+	ctx := context.Background()
+	TestHelper.WithDataPlaneNamespace(ctx, "smoke-test", map[string]string{}, t, func(t *testing.T, ns string) {
+		cmd := []string{"inject", "testdata/smoke_test.yaml"}
+		out, injectReport, err := TestHelper.PipeToLinkerdRun("", cmd...)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
+				"'linkerd inject' command failed: %s\n%s", err, out)
+		}
+
+		err = TestHelper.ValidateOutput(injectReport, "inject.report.golden")
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "received unexpected output",
+				"received unexpected output\n%s", err.Error())
+		}
+
+		out, err = TestHelper.KubectlApply(out, ns)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "'kubectl apply' command failed",
+				"'kubectl apply' command failed\n%s", out)
+		}
+
+		// Wait for pods to in smoke-test dpeloyment to come up
+		for _, deploy := range []string{"smoke-test-terminus", "smoke-test-gateway"} {
+			if err := TestHelper.CheckPods(ctx, ns, deploy, 1); err != nil {
+				if rce, ok := err.(*testutil.RestartCountError); ok {
+					testutil.AnnotatedWarn(t, "CheckPods timed-out", rce)
+				} else {
+					testutil.AnnotatedFatal(t, "CheckPods timed-out", err)
+				}
+			}
+		}
+
+		// Test 'linkerd check --proxy' with the current image version
+		cmd = []string{"check", "--proxy", "--expected-version", TestHelper.GetVersion(), "--namespace", ns, "--wait=60m"}
+		expected := getCheckOutput(t, "check.proxy.golden", TestHelper.GetLinkerdNamespace())
+
+		// Use a short time window for check tests to get rid of transient
+		// errors
+		timeout := 5 * time.Minute
+		err = TestHelper.RetryFor(timeout, func() error {
+			out, err := TestHelper.LinkerdRun(cmd...)
+			if err != nil {
+				return fmt.Errorf("'linkerd check' command failed\n%s\n%s", err, out)
+			}
+
+			if !strings.Contains(out, expected) {
+				return fmt.Errorf(
+					"Expected:\n%s\nActual:\n%s", expected, out)
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			testutil.AnnotatedFatal(t, fmt.Sprintf("'linkerd check' command timed-out (%s)", timeout), err)
+		}
+
+		// Test traffic from smoke-test client to server
+		url, err := TestHelper.URLFor(ctx, ns, "smoke-test-gateway", 8080)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "failed to get URL",
+				"failed to get URL: %s", err)
+		}
+
+		output, err := TestHelper.HTTPGetURL(url)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "unexpected error",
+				"unexpected error: %v %s", err, output)
+		}
+
+		expectedStringInPayload := "\"payload\":\"BANANA\""
+		if !strings.Contains(output, expectedStringInPayload) {
+			testutil.AnnotatedFatalf(t, "application response doesn't contain the expected response",
+				"expected application response to contain string [%s], but it was [%s]",
+				expectedStringInPayload, output)
+		}
+	})
+
+}
+
+func getCheckOutput(t *testing.T, goldenFile string, namespace string) string {
+	pods, err := TestHelper.KubernetesHelper.GetPods(context.Background(), namespace, nil)
+	if err != nil {
+		testutil.AnnotatedFatal(t, fmt.Sprintf("failed to retrieve pods: %s", err), err)
+	}
+
+	proxyVersionErr := ""
+	err = healthcheck.CheckProxyVersionsUpToDate(pods, version.Channels{})
+	if err != nil {
+		proxyVersionErr = err.Error()
+	}
+
+	tpl := template.Must(template.ParseFiles("testdata" + "/" + goldenFile))
+	vars := struct {
+		ProxyVersionErr string
+		HintURL         string
+	}{
+		proxyVersionErr,
+		healthcheck.HintBaseURL(TestHelper.GetVersion()),
+	}
+
+	var expected bytes.Buffer
+	if err := tpl.Execute(&expected, vars); err != nil {
+		testutil.AnnotatedFatal(t, fmt.Sprintf("failed to parse %s template: %s", goldenFile, err), err)
+	}
+
+	return expected.String()
+}
diff --git a/test/integration/smoke/testdata/check.proxy.golden b/test/integration/smoke/testdata/check.proxy.golden
new file mode 100644
index 000000000..8ce22e02f
--- /dev/null
+++ b/test/integration/smoke/testdata/check.proxy.golden
@@ -0,0 +1,78 @@
+Linkerd core checks
+===================
+
+kubernetes-api
+--------------
+√ can initialize the client
+√ can query the Kubernetes API
+
+kubernetes-version
+------------------
+√ is running the minimum Kubernetes API version
+√ is running the minimum kubectl version
+
+linkerd-existence
+-----------------
+√ 'linkerd-config' config map exists
+√ heartbeat ServiceAccount exist
+√ control plane replica sets are ready
+√ no unschedulable pods
+√ control plane pods are ready
+√ cluster networks contains all node podCIDRs
+
+linkerd-config
+--------------
+√ control plane Namespace exists
+√ control plane ClusterRoles exist
+√ control plane ClusterRoleBindings exist
+√ control plane ServiceAccounts exist
+√ control plane CustomResourceDefinitions exist
+√ control plane MutatingWebhookConfigurations exist
+√ control plane ValidatingWebhookConfigurations exist
+√ proxy-init container runs as root user if docker container runtime is used
+
+linkerd-identity
+----------------
+√ certificate config is valid
+√ trust anchors are using supported crypto algorithm
+√ trust anchors are within their validity period
+√ trust anchors are valid for at least 60 days
+√ issuer cert is using supported crypto algorithm
+√ issuer cert is within its validity period
+√ issuer cert is valid for at least 60 days
+√ issuer cert is issued by the trust anchor
+
+linkerd-webhooks-and-apisvc-tls
+-------------------------------
+√ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
+√ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
+√ policy-validator webhook has valid cert
+√ policy-validator cert is valid for at least 60 days
+
+linkerd-identity-data-plane
+---------------------------
+√ data plane proxies certificate match CA
+
+linkerd-version
+---------------
+√ can determine the latest version
+√ cli is up-to-date
+
+linkerd-control-plane-proxy
+---------------------------
+√ control plane proxies are healthy
+√ control plane proxies are up-to-date
+√ control plane proxies and cli versions match
+
+linkerd-data-plane
+------------------
+√ data plane namespace exists
+√ data plane proxies are ready
+√ data plane is up-to-date
+√ data plane and cli versions match
+√ data plane pod labels are configured correctly
+√ data plane service labels are configured correctly
+√ data plane service annotations are configured correctly
+√ opaque ports are properly annotated
diff --git a/test/integration/smoke/testdata/inject.report.golden b/test/integration/smoke/testdata/inject.report.golden
new file mode 100644
index 000000000..d1b4570b5
--- /dev/null
+++ b/test/integration/smoke/testdata/inject.report.golden
@@ -0,0 +1,10 @@
+
+deployment "smoke-test-terminus" injected
+service "smoke-test-terminus-svc" skipped
+server "smoke-test-terminus" skipped
+serverauthorization "smoke-test-terminus" skipped
+deployment "smoke-test-gateway" injected
+service "smoke-test-gateway-svc" skipped
+server "smoke-test-proxy-admin" skipped
+serverauthorization "smoke-test-proxy-admin" skipped
+
diff --git a/test/integration/testdata/smoke_test.yaml b/test/integration/smoke/testdata/smoke_test.yaml
similarity index 100%
rename from test/integration/testdata/smoke_test.yaml
rename to test/integration/smoke/testdata/smoke_test.yaml
diff --git a/testutil/inject_validator.go b/testutil/inject_validator.go
index 15ebdde46..670429272 100644
--- a/testutil/inject_validator.go
+++ b/testutil/inject_validator.go
@@ -18,7 +18,6 @@ const enabled = "true"
 // injected pods
 type InjectValidator struct {
 	NoInitContainer         bool
-	DisableIdentity         bool
 	AutoInject              bool
 	AdminPort               int
 	ControlPort             int
@@ -429,11 +428,6 @@ func (iv *InjectValidator) GetFlagsAndAnnotations() ([]string, map[string]string
 		flags = append(flags, fmt.Sprintf("--control-port=%s", strconv.Itoa(iv.ControlPort)))
 	}
 
-	if iv.DisableIdentity {
-		annotations[k8s.IdentityModeDisabled] = enabled
-		flags = append(flags, "--disable-identity")
-	}
-
 	if iv.EnableDebug {
 		annotations[k8s.ProxyEnableDebugAnnotation] = enabled
 		flags = append(flags, "--enable-debug-sidecar")