---
###
### Linkerd Viz Extension Namespace
###
kind: Namespace
apiVersion: v1
metadata:
  name: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
  annotations:
    linkerd.io/inject: enabled
---
###
### Metrics API RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-metrics-api
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["split.smi-spec.io"]
  resources: ["trafficsplits"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-metrics-api
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-metrics-api
subjects:
- kind: ServiceAccount
  name: linkerd-metrics-api
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-metrics-api
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
---
###
### Grafana RBAC
###
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
---
###
### Tap RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
rules:
- apiGroups: [""]
  resources: ["pods", "services", "replicationcontrollers", "namespaces", "nodes"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap-admin
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
rules:
- apiGroups: ["tap.linkerd.io"]
  resources: ["*"]
  verbs: ["watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-tap
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-viz-tap-auth-delegator
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-linkerd-viz-tap-auth-reader
  namespace: kube-system
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-tap-k8s-tls
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
  tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
  tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.tap.linkerd.io
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
spec:
  group: tap.linkerd.io
  version: v1alpha1
  groupPriorityMinimum: 1000
  versionPriority: 100
  service:
    name: linkerd-tap
    namespace: linkerd-viz
  caBundle: dGVzdC10YXAtY2EtYnVuZGxl
---
###
### Web RBAC
###
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
  resourceNames: ["linkerd-config"]
- apiGroups: [""]
  resources: ["namespaces", "configmaps"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["serviceaccounts", "pods"]
  verbs: ["list"]
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd
roleRef:
  kind: Role
  name: linkerd-web
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: linkerd-linkerd-viz-web-check
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings"]
  verbs: ["list"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["list"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  verbs: ["list"]
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  verbs: ["list"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list"]
- apiGroups: ["apiregistration.k8s.io"]
  resources: ["apiservices"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-viz-web-check
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-viz-web-check
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-web-admin
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-tap-admin
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-viz-psp
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    namespace: linkerd-viz
roleRef:
  kind: Role
  name: linkerd-psp
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
- kind: ServiceAccount
  name: linkerd-grafana
  namespace: linkerd-viz
---
###
### Metrics API
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-metrics-api
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
  ports:
  - name: http
    port: 8085
    targetPort: 8085
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: metrics-api
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: metrics-api
  name: linkerd-metrics-api
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: metrics-api
  template:
    metadata:
      annotations:
        checksum/config: 6827b2203b1cd90692d9dd6a973a2162e574dc9fd7b5b9e346ceac7e287204a6
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: metrics-api
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - -controller-namespace=linkerd
        - -log-level=info
        - -cluster-domain=cluster.local
        - -prometheus-url=external-prom.com
        image: ghcr.io/linkerd/metrics-api:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9995
          initialDelaySeconds: 10
        name: metrics-api
        ports:
        - containerPort: 8085
          name: http
        - containerPort: 9995
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9995
        resources:
        securityContext:
          runAsUser: 2103
      serviceAccountName: linkerd-metrics-api
---
###
### Grafana
###
kind: ConfigMap
apiVersion: v1
metadata:
  name: linkerd-grafana-config
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
data:
  grafana.ini: |-
    instance_name = linkerd-grafana
    [server]
    root_url = %(protocol)s://%(domain)s:/grafana/
    [auth]
    disable_login_form = true
    [auth.anonymous]
    enabled = true
    org_role = Editor
    [auth.basic]
    enabled = false
    [analytics]
    check_for_updates = false
    [panels]
    disable_sanitize_html = true
  datasources.yaml: |-
    apiVersion: 1
    datasources:
    - name: prometheus
      type: prometheus
      access: proxy
      orgId: 1
      url: external-prom.com
      isDefault: true
      jsonData:
        timeInterval: "5s"
      version: 1
      editable: true

  dashboards.yaml: |-
    apiVersion: 1
    providers:
    - name: 'default'
      orgId: 1
      folder: ''
      type: file
      disableDeletion: true
      editable: true
      options:
        path: /var/lib/grafana/dashboards
        homeDashboardId: linkerd-top-line
---
kind: Service
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: grafana
  ports:
  - name: http
    port: 3000
    targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: grafana
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: grafana
    namespace: linkerd-viz
  name: linkerd-grafana
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: grafana
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: grafana
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - env:
        - name: GF_PATHS_DATA
          value: /data
        # Force using the go-based DNS resolver instead of the OS' to avoid failures in some environments
        # see https://github.com/grafana/grafana/issues/20096
        - name: GODEBUG
          value: netdns=go
        image: ghcr.io/linkerd/grafana:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /api/health
            port: 3000
          initialDelaySeconds: 30
        name: grafana
        ports:
        - containerPort: 3000
          name: http
        readinessProbe:
          httpGet:
            path: /api/health
            port: 3000
        resources:
        securityContext:
          runAsUser: 472
        volumeMounts:
        - mountPath: /data
          name: data
        - mountPath: /etc/grafana
          name: grafana-config
          readOnly: true
      serviceAccountName: linkerd-grafana
      volumes:
      - emptyDir: {}
        name: data
      - configMap:
          items:
          - key: grafana.ini
            path: grafana.ini
          - key: datasources.yaml
            path: provisioning/datasources/datasources.yaml
          - key: dashboards.yaml
            path: provisioning/dashboards/dashboards.yaml
          name: linkerd-grafana-config
        name: grafana-config
---
###
### Tap
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: tap
  ports:
  - name: grpc
    port: 8088
    targetPort: 8088
  - name: apiserver
    port: 443
    targetPort: apiserver
---
kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: tap
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: tap
    namespace: linkerd-viz
  name: linkerd-tap
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: tap
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        checksum/config: bbc82b03e8c9fdc549e1ef5d3f795c07c21fb3b4c089351186f170b722689d86
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: tap
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - api
        - -api-namespace=linkerd
        - -log-level=info
        - -identity-trust-domain=cluster.local
        image: ghcr.io/linkerd/tap:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9998
          initialDelaySeconds: 10
        name: tap
        ports:
        - containerPort: 8088
          name: grpc
        - containerPort: 8089
          name: apiserver
        - containerPort: 9998
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9998
        resources:
        securityContext:
          runAsUser: 2103
        volumeMounts:
        - mountPath: /var/run/linkerd/tls
          name: tls
          readOnly: true
      serviceAccountName: linkerd-tap
      volumes:
      - name: tls
        secret:
          secretName: linkerd-tap-k8s-tls

---
###
### Tap Injector RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-tap-injector
  labels:
    linkerd.io/extension: linkerd-viz
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-tap-injector
  labels:
    linkerd.io/extension: linkerd-viz
subjects:
- kind: ServiceAccount
  name: tap-injector
  namespace: linkerd-viz
roleRef:
  kind: ClusterRole
  name: linkerd-tap-injector
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: tap-injector
  namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
  name: tap-injector-k8s-tls
  namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
  tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
  tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: linkerd-tap-injector-webhook-config
  labels:
    linkerd.io/extension: linkerd-viz
webhooks:
- name: tap-injector.linkerd.io
  clientConfig:
    service:
      name: tap-injector
      namespace: linkerd-viz
      path: "/"
    caBundle: dGVzdC10YXAtY2EtYnVuZGxl
  failurePolicy: Ignore
  admissionReviewVersions: ["v1", "v1beta1"]
  reinvocationPolicy: IfNeeded
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  sideEffects: None
---
###
### Tap Injector
###
kind: Service
apiVersion: v1
metadata:
  name: tap-injector
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap-injector
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    component: tap-injector
  ports:
  - name: tap-injector
    port: 443
    targetPort: tap-injector
---
kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: tap-injector
    app.kubernetes.io/part-of: Linkerd
    component: tap-injector
  name: tap-injector
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      component: tap-injector
  template:
    metadata:
      annotations:
        checksum/config: 0120b5feafdef04a057ab39fd63ed315ebbcc2bfc0b0657e3007fa34ffb8b7e2
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: tap-injector
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - injector
        - -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
        - -log-level=info
        image: ghcr.io/linkerd/tap:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9995
          initialDelaySeconds: 10
        name: tap-injector
        ports:
        - containerPort: 8443
          name: tap-injector
        - containerPort: 9995
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9995
        resources:
        securityContext:
          runAsUser: 2103
        volumeMounts:
        - mountPath: /var/run/linkerd/tls
          name: tls
          readOnly: true
      serviceAccountName: tap-injector
      volumes:
      - name: tls
        secret:
          secretName: tap-injector-k8s-tls
---
###
### Web
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: web
  ports:
  - name: http
    port: 8084
    targetPort: 8084
  - name: admin-http
    port: 9994
    targetPort: 9994
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: web
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: web
    namespace: linkerd-viz
  name: linkerd-web
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: web
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: web
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - -linkerd-controller-api-addr=linkerd-controller-api.linkerd.svc.cluster.local:8085
        - -linkerd-metrics-api-addr=linkerd-metrics-api.linkerd-viz.svc.cluster.local:8085
        - -cluster-domain=cluster.local
        - -grafana-addr=linkerd-grafana.linkerd-viz.svc.cluster.local:3000
        - -controller-namespace=linkerd
        - -viz-namespace=linkerd-viz
        - -log-level=info
        - -enforced-host=^(localhost|127\.0\.0\.1|linkerd-web\.linkerd-viz\.svc\.cluster\.local|linkerd-web\.linkerd-viz\.svc|\[::1\])(:\d+)?$
        image: ghcr.io/linkerd/web:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9994
          initialDelaySeconds: 10
        name: web
        ports:
        - containerPort: 8084
          name: http
        - containerPort: 9994
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9994
        resources:
        securityContext:
          runAsUser: 2103
      serviceAccountName: linkerd-web