This edge release continues the work of adding support for mTLS for all TCP traffic and changes the default container registry to `ghcr.io` from `gcr.io`. If you are upgrading from `stable-2.8.x` with the Linkerd CLI using the `linkerd upgrade` command, you must add the `--addon-overwrite` flag to ensure that the grafana image is properly set. * Removed the default timeout for ServiceProfiles so that ServiceProfile routes behave the same as when there is no ServiceProfile definition * Changed default docker image repository to ghcr.io from gcr.io. **Users who pull the images into private repositories should take note of this change** * Added endpoint labels to outbound TCP metrics to provide more context and detail for the metrics, add load balancing to TCP connections (bypassing kube-proxy), and secure the connection with mTLS when both endpoints are meshed * Made unnamed ServiceProfile discovery configurable using the `proxy.destinationGetNetworks` variable to set the `LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS` variable in the proxy chart template * Added TLS certificate validation for the Injector, SP Validator, and Tap webhooks to the `linkerd check` command