Make IPv6 support opt-in (#12576)

This changes the default of the Helm value `disableIPv6` to `true`.
Additionally, the proxy's `LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS` env var
is now set accordingly to that value.

This addresses an incompatibility with GKE introduced in last week's
edge (`edge-24.5.1`): in default IPv4-only nodes in GKE clusters the
proxy can't bind to `::1`, so we have make IPv6 opt-in to avoid
surprises.

charts/linkerd-control-plane/values.yaml

@@ -44,7 +44,7 @@ enablePodDisruptionBudget: false
 # -- disables routing IPv6 traffic in addition to IPv4 traffic through the
 # proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni
 # v1.4.0)
-disableIPv6: false
+disableIPv6: true
 
 controller:
   # -- sets pod disruption budget parameter for all deployments

charts/partials/templates/_proxy.tpl

@@ -83,7 +83,7 @@ env:
 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
   value: "127.0.0.1:{{.Values.proxy.ports.outbound}}"
 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-  value: "127.0.0.1:{{.Values.proxy.ports.outbound}},[::1]:{{.Values.proxy.ports.outbound}}"
+  value: "127.0.0.1:{{.Values.proxy.ports.outbound}}{{ if not .Values.disableIPv6}},[::1]:{{.Values.proxy.ports.outbound}}{{ end }}"
 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
   value: "[::]:{{.Values.proxy.ports.inbound}}"
 - name: LINKERD2_PROXY_INBOUND_IPS

cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml

@@ -70,7 +70,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -181,6 +181,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml

@@ -70,7 +70,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -181,6 +181,7 @@ spec:
           name: server
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -303,7 +304,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -414,6 +415,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml

@@ -70,7 +70,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -181,6 +181,7 @@ spec:
           name: server
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_contour.golden.yml

@@ -78,7 +78,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -221,6 +221,7 @@ spec:
         - mountPath: /config
           name: contour-config
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -192,6 +192,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -316,7 +317,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -436,6 +437,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -560,7 +562,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -680,6 +682,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -804,7 +807,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -924,6 +927,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -192,6 +192,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -195,6 +195,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -184,6 +184,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -205,6 +205,7 @@ spec:
           runAsUser: 33
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml

@@ -82,7 +82,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -209,6 +209,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -192,6 +192,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -316,7 +317,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -436,6 +437,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -205,6 +205,7 @@ spec:
         terminationMessagePolicy: FallbackToLogsOnError
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -192,6 +192,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -193,6 +193,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml

@@ -38,6 +38,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -125,7 +126,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS

cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS

cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -193,6 +193,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -193,6 +193,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -192,6 +192,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml

@@ -74,7 +74,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -194,6 +194,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml

@@ -72,7 +72,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -194,6 +194,7 @@ spec:
           protocol: UDP
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_list.golden.yml

@@ -74,7 +74,7 @@ items:
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
             value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-            value: 127.0.0.1:4140,[::1]:4140
+            value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
             value: '[::]:4143'
           - name: LINKERD2_PROXY_INBOUND_IPS
@@ -194,6 +194,7 @@ items:
             name: http
         initContainers:
         - args:
+          - --ipv6=false
           - --incoming-proxy-port
           - "4143"
           - --outgoing-proxy-port
@@ -317,7 +318,7 @@ items:
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
             value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-            value: 127.0.0.1:4140,[::1]:4140
+            value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
             value: '[::]:4143'
           - name: LINKERD2_PROXY_INBOUND_IPS
@@ -432,6 +433,7 @@ items:
             protocol: TCP
         initContainers:
         - args:
+          - --ipv6=false
           - --incoming-proxy-port
           - "4143"
           - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml

@@ -74,7 +74,7 @@ items:
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
             value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-            value: 127.0.0.1:4140,[::1]:4140
+            value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
             value: '[::]:4143'
           - name: LINKERD2_PROXY_INBOUND_IPS
@@ -194,6 +194,7 @@ items:
             name: http
         initContainers:
         - args:
+          - --ipv6=false
           - --incoming-proxy-port
           - "4143"
           - --outgoing-proxy-port
@@ -317,7 +318,7 @@ items:
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
             value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-            value: 127.0.0.1:4140,[::1]:4140
+            value: 127.0.0.1:4140
           - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
             value: '[::]:4143'
           - name: LINKERD2_PROXY_INBOUND_IPS
@@ -432,6 +433,7 @@ items:
             protocol: TCP
         initContainers:
         - args:
+          - --ipv6=false
           - --incoming-proxy-port
           - "4143"
           - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_pod.golden.yml

@@ -64,7 +64,7 @@ spec:
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
       value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-      value: 127.0.0.1:4140,[::1]:4140
+      value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
       value: '[::]:4143'
     - name: LINKERD2_PROXY_INBOUND_IPS
@@ -176,6 +176,7 @@ spec:
     name: vote-bot
   initContainers:
   - args:
+    - --ipv6=false
     - --incoming-proxy-port
     - "4143"
     - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml

@@ -65,7 +65,7 @@ spec:
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
       value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-      value: 127.0.0.1:4140,[::1]:4140
+      value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
       value: '[::]:4143'
     - name: LINKERD2_PROXY_INBOUND_IPS
@@ -179,6 +179,7 @@ spec:
     name: vote-bot
   initContainers:
   - args:
+    - --ipv6=false
     - --incoming-proxy-port
     - "4143"
     - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml

@@ -66,7 +66,7 @@ spec:
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
       value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-      value: 127.0.0.1:4140,[::1]:4140
+      value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
       value: '[::]:4143'
     - name: LINKERD2_PROXY_INBOUND_IPS
@@ -178,6 +178,7 @@ spec:
     name: vote-bot
   initContainers:
   - args:
+    - --ipv6=false
     - --incoming-proxy-port
     - "4143"
     - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml

@@ -68,7 +68,7 @@ spec:
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
       value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-      value: 127.0.0.1:4140,[::1]:4140
+      value: 127.0.0.1:4140
     - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
       value: '[::]:4143'
     - name: LINKERD2_PROXY_INBOUND_IPS
@@ -187,6 +187,7 @@ spec:
     name: vote-bot
   initContainers:
   - args:
+    - --ipv6=false
     - --incoming-proxy-port
     - "4143"
     - --outgoing-proxy-port

cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml

@@ -73,7 +73,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -193,6 +193,7 @@ spec:
           name: http
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_gettest_deployment.good.golden.yml

@@ -68,7 +68,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -194,6 +194,7 @@ spec:
         - containerPort: 9090
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -314,7 +315,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -440,6 +441,7 @@ spec:
         - containerPort: 9090
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/inject_tap_deployment_debug.golden.yml

@@ -89,7 +89,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: 127.0.0.1:4140,[::1]:4140
+          value: 127.0.0.1:4140
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: '[::]:4143'
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -254,6 +254,7 @@ spec:
       dnsPolicy: ClusterFirst
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_controlplane_tracing_output.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1019,7 +1019,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1113,6 +1113,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1366,7 +1367,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1476,7 +1477,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         - -trace-collector=collector.linkerd-jaeger.svc.cluster.local:55678
@@ -1597,6 +1598,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1815,7 +1817,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1958,6 +1960,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_custom_domain.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_custom_registry.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: my.custom.registry/linkerd-io/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_default.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_default_override_dst_get_nets.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_default_token.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1110,6 +1110,7 @@ spec:
           name: linkerd-identity-end-entity
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1356,7 +1357,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1464,7 +1465,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1584,6 +1585,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1795,7 +1797,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1936,6 +1938,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_ha_output.golden

@@ -534,7 +534,7 @@ data:
         limit: 250Mi
         request: 50Mi
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1095,7 +1095,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1194,6 +1194,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1482,7 +1483,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1597,7 +1598,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1723,6 +1724,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1966,7 +1968,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -2120,6 +2122,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_ha_with_overrides_output.golden

@@ -534,7 +534,7 @@ data:
         limit: 250Mi
         request: 50Mi
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1095,7 +1095,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1194,6 +1194,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1482,7 +1483,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1597,7 +1598,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1723,6 +1724,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1966,7 +1968,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -2120,6 +2122,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_heartbeat_disabled_output.golden

@@ -456,7 +456,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: true
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -949,7 +949,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1043,6 +1043,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1296,7 +1297,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1406,7 +1407,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1526,6 +1527,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1684,7 +1686,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1827,6 +1829,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_helm_control_plane_output.golden

@@ -526,7 +526,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -991,7 +991,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1085,6 +1085,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1340,7 +1341,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1450,7 +1451,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=test.trust.domain
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:linkerd-version
@@ -1570,6 +1571,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1792,7 +1794,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1935,6 +1937,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_helm_control_plane_output_ha.golden

@@ -535,7 +535,7 @@ data:
         limit: 250Mi
         request: 50Mi
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1068,7 +1068,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1167,6 +1167,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1457,7 +1458,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1572,7 +1573,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=test.trust.domain
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:linkerd-version
@@ -1698,6 +1699,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1945,7 +1947,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -2099,6 +2101,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_helm_output_ha_labels.golden

@@ -535,7 +535,7 @@ data:
         limit: 250Mi
         request: 50Mi
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1076,7 +1076,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1175,6 +1175,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1469,7 +1470,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1584,7 +1585,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=test.trust.domain
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:linkerd-version
@@ -1710,6 +1711,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1965,7 +1967,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -2119,6 +2121,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden

@@ -530,7 +530,7 @@ data:
         limit: 250Mi
         request: 50Mi
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1058,7 +1058,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1157,6 +1157,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1447,7 +1448,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1562,7 +1563,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=test.trust.domain
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:linkerd-version
@@ -1688,6 +1689,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1935,7 +1937,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -2089,6 +2091,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_no_init_container.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1359,7 +1359,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1469,7 +1469,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1801,7 +1801,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS

cli/cmd/testdata/install_proxy_ignores.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=cluster.local
         - -identity-trust-domain=cluster.local
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

cli/cmd/testdata/install_values_file.golden

@@ -525,7 +525,7 @@ data:
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
-    disableIPv6: false
+    disableIPv6: true
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1018,7 +1018,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1112,6 +1112,7 @@ spec:
           name: linkerd-identity-token
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1365,7 +1366,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1475,7 +1476,7 @@ spec:
         - -cluster-domain=example.com
         - -identity-trust-domain=example.com
         - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
-        - -enable-ipv6=true
+        - -enable-ipv6=false
         - -enable-pprof=false
         - --meshed-http2-client-params={"keep_alive":{"interval":{"seconds":10},"timeout":{"seconds":3},"while_idle":true}}
         image: cr.l5d.io/linkerd/controller:install-control-plane-version
@@ -1595,6 +1596,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port
@@ -1813,7 +1815,7 @@ spec:
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
           value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
-          value: "127.0.0.1:4140,[::1]:4140"
+          value: "127.0.0.1:4140"
         - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
           value: "[::]:4143"
         - name: LINKERD2_PROXY_INBOUND_IPS
@@ -1956,6 +1958,7 @@ spec:
           readOnly: true
       initContainers:
       - args:
+        - --ipv6=false
         - --incoming-proxy-port
         - "4143"
         - --outgoing-proxy-port

controller/proxy-injector/fake/data/pod-with-debug.patch.json

@@ -47,6 +47,7 @@
     "path": "/spec/initContainers/-",
     "value": {
       "args": [
+        "--ipv6=false",
         "--incoming-proxy-port",
         "4143",
         "--outgoing-proxy-port",
@@ -251,7 +252,7 @@
         },
         {
           "name": "LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS",
-          "value": "127.0.0.1:4140,[::1]:4140"
+          "value": "127.0.0.1:4140"
         },
         {
           "name": "LINKERD2_PROXY_INBOUND_LISTEN_ADDR",

controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json

@@ -57,6 +57,7 @@
     "path": "/spec/initContainers/-",
     "value": {
       "args": [
+        "--ipv6=false",
         "--incoming-proxy-port",
         "4143",
         "--outgoing-proxy-port",
@@ -237,7 +238,7 @@
         },
         {
           "name": "LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS",
-          "value": "127.0.0.1:4140,[::1]:4140"
+          "value": "127.0.0.1:4140"
         },
         {
           "name": "LINKERD2_PROXY_INBOUND_LISTEN_ADDR",

controller/proxy-injector/fake/data/pod.patch.json

@@ -47,6 +47,7 @@
     "path": "/spec/initContainers/-",
     "value": {
       "args": [
+        "--ipv6=false",
         "--incoming-proxy-port",
         "4143",
         "--outgoing-proxy-port",
@@ -227,7 +228,7 @@
         },
         {
           "name": "LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS",
-          "value": "127.0.0.1:4140,[::1]:4140"
+          "value": "127.0.0.1:4140"
         },
         {
           "name": "LINKERD2_PROXY_INBOUND_LISTEN_ADDR",

pkg/charts/linkerd2/values_test.go

@@ -67,7 +67,7 @@ func TestNewValues(t *testing.T) {
 		PodAnnotations:               map[string]string{},
 		PodLabels:                    map[string]string{},
 		EnableEndpointSlices:         true,
-		DisableIPv6:                  false,
+		DisableIPv6:                  true,
 		EnablePodDisruptionBudget:    false,
 		Controller: &Controller{
 			PodDisruptionBudget: &PodDisruptionBudget{

test/integration/deep/norelay/norelay_test.go

@@ -73,11 +73,19 @@ func TestNoRelay(t *testing.T) {
 func TestRelay(t *testing.T) {
 	ctx := context.Background()
 	deployments := getDeployments(t)
+
+	// account for both when IPv6 is enabled or disabled
 	deployments["server-relay"] = strings.ReplaceAll(
 		deployments["server-relay"],
 		"127.0.0.1:4140,[::1]:4140",
 		"'[::]:4140'",
 	)
+	deployments["server-relay"] = strings.ReplaceAll(
+		deployments["server-relay"],
+		"127.0.0.1:4140",
+		"0.0.0.0:4140",
+	)
+
 	TestHelper.WithDataPlaneNamespace(ctx, "relay-test", map[string]string{}, t, func(t *testing.T, ns string) {
 		for name, res := range deployments {
 			out, err := TestHelper.KubectlApply(res, ns)

test/integration/install/inject/inject_test.go

@@ -396,6 +396,7 @@ func TestInjectAutoPod(t *testing.T) {
 		Name:  k8s.InitContainerName,
 		Image: reg + "/proxy-init:" + version.ProxyInitVersion,
 		Args: []string{
+			"--ipv6=false",
 			"--incoming-proxy-port", "4143",
 			"--outgoing-proxy-port", "4140",
 			"--proxy-uid", "2102",

testutil/inject_validator.go

@@ -158,7 +158,7 @@ func (iv *InjectValidator) validateProxyContainer(pod *v1.PodSpec) error {
 		if err := iv.validateEnvVar(
 			proxyContainer,
 			"LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS",
-			fmt.Sprintf("127.0.0.1:%d,[::1]:%d", iv.OutboundPort, iv.OutboundPort),
+			fmt.Sprintf("127.0.0.1:%d", iv.OutboundPort),
 		); err != nil {
 			return err
 		}