In order to closely track a release train (especially edge), it would be nice to have an auto-update operator that is responsible for watching the version-check api and replacing linkerd controller pods (possibly after some user ack).

Furthermore, this may motivate changing the inject flow to make the controller process the YAML. With auto-inject, and the general desire to have cluster-wide policy, like skip-port whitelists, profile domain policy, etc. This would also reduce the logic related to auto-inject.

It would ideally also update itself in a way that allowed it to ensure the new updater is healthy before closing gracefully (i.e., not bluntly overwriting its own kubernetes resource).