From 983e6944bb71024e86104d53bb2ff4b0085530e8 Mon Sep 17 00:00:00 2001
From: Travis Beckham <travis@buoyant.io>
Date: Mon, 6 Jul 2026 15:57:47 -0500
Subject: [PATCH 1/3] Add command-output shortcode; Update troubleshooting doc

Signed-off-by: Travis Beckham <travis@buoyant.io>
---
 .../assets/scss/abstracts/_abstracts.scss     |   5 +
 linkerd.io/assets/scss/base/_base.scss        |   2 +-
 .../scss/components/_command-output.scss      |  57 ++++
 linkerd.io/assets/scss/main.scss              |   1 +
 .../content/2-edge/tasks/troubleshooting.md   | 291 ++++++++++++++++--
 .../content/docs/tasks/troubleshooting.md     | 291 ++++++++++++++++--
 linkerd.io/content/tests/shortcodes.md        |  11 +
 .../layouts/_shortcodes/command-output.html   |  41 +++
 8 files changed, 640 insertions(+), 59 deletions(-)
 create mode 100644 linkerd.io/assets/scss/components/_command-output.scss
 create mode 100644 linkerd.io/layouts/_shortcodes/command-output.html

diff --git a/linkerd.io/assets/scss/abstracts/_abstracts.scss b/linkerd.io/assets/scss/abstracts/_abstracts.scss
index 3ed40f96e3..125f81eaad 100644
--- a/linkerd.io/assets/scss/abstracts/_abstracts.scss
+++ b/linkerd.io/assets/scss/abstracts/_abstracts.scss
@@ -107,6 +107,11 @@ $info-color: $blue;
 $warning-color: rgb(255, 193, 7);
 $danger-color: rgb(220, 53, 69);
 
+// https://xyproto.github.io/splash/docs/github-dark.html
+$highlight-background-color: #0d1117;
+$highlight-text-color: #e6edf3;
+$highlight-comment-color: #8b949e;
+
 $state-colors: (
   primary: (
     text: shade-color($primary-color, 60%),
diff --git a/linkerd.io/assets/scss/base/_base.scss b/linkerd.io/assets/scss/base/_base.scss
index f3f529673a..24aa8576c2 100644
--- a/linkerd.io/assets/scss/base/_base.scss
+++ b/linkerd.io/assets/scss/base/_base.scss
@@ -114,7 +114,7 @@ blockquote {
   border-left: solid 4px abstracts.$blue;
   background-color: abstracts.$light-blue;
   border-radius: abstracts.$border-radius;
-  
+
   & > :last-child {
     margin-bottom: 0;
   }
diff --git a/linkerd.io/assets/scss/components/_command-output.scss b/linkerd.io/assets/scss/components/_command-output.scss
new file mode 100644
index 0000000000..fcb2a528d2
--- /dev/null
+++ b/linkerd.io/assets/scss/components/_command-output.scss
@@ -0,0 +1,57 @@
+@use "../abstracts";
+
+// See: /layouts/shortcodes/command-output.html
+
+/*
+@markup
+<div class="command-output">
+  <div class="command-output__command">
+    <div class="highlight">
+      <pre>
+        <code>
+          <span>...
+        </code>
+      </pre>
+    </div>
+  </div>
+  <div class="command-output__label">
+    Label
+  </div>
+  <div class="command-output__output">
+    <div class="highlight disable-copy">
+      <pre>
+        <code class="language-plaintext" data-lang="plaintext">
+          ...
+        </code>
+      </pre>
+    </div>
+  </div>
+</div>
+*/
+
+.command-output {
+  margin-bottom: abstracts.size(3);
+  background-color: abstracts.$highlight-background-color;
+  border-radius: abstracts.$border-radius;
+
+  .highlight {
+    margin-bottom: 0;
+  }
+  .command-output__command pre code > span::before {
+    content: "$ ";
+    color: abstracts.$highlight-comment-color;
+    user-select: none;
+  }
+  .command-output__label {
+    padding: abstracts.size(2) abstracts.size(3);
+    border-bottom: solid 2px rgba(abstracts.$highlight-comment-color, 0.4);
+    color: abstracts.$highlight-comment-color;
+    font-size: abstracts.$font-size-sm;
+  }
+  & > * {
+    border-bottom: solid 2px abstracts.$white;
+  }
+  & > :last-child {
+    border-bottom: none;
+  }
+}
diff --git a/linkerd.io/assets/scss/main.scss b/linkerd.io/assets/scss/main.scss
index f93a9d5e99..ee5a8c9942 100644
--- a/linkerd.io/assets/scss/main.scss
+++ b/linkerd.io/assets/scss/main.scss
@@ -12,6 +12,7 @@
 @use "components/badge";
 @use "components/button";
 @use "components/card";
+@use "components/command-output";
 @use "components/form-control";
 @use "components/hero";
 @use "components/highlight";
diff --git a/linkerd.io/content/2-edge/tasks/troubleshooting.md b/linkerd.io/content/2-edge/tasks/troubleshooting.md
index c574f7b2ce..a9081f9e9b 100644
--- a/linkerd.io/content/2-edge/tasks/troubleshooting.md
+++ b/linkerd.io/content/2-edge/tasks/troubleshooting.md
@@ -229,21 +229,29 @@ Example failure:
 
 Ensure the Linkerd ClusterRoles exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterroles | grep linkerd
-linkerd-linkerd-destination                                            9d
-linkerd-linkerd-identity                                               9d
-linkerd-linkerd-proxy-injector                                         9d
-linkerd-policy                                                         9d
+linkerd-linkerd-destination       9d
+linkerd-linkerd-identity          9d
+linkerd-linkerd-proxy-injector    9d
+linkerd-policy                    9d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterroles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ClusterRoleBindings exist {#l5d-existence-crb}
 
 Example failure:
@@ -256,21 +264,29 @@ Example failure:
 
 Ensure the Linkerd ClusterRoleBindings exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebindings | grep linkerd
-linkerd-linkerd-destination                            9d
-linkerd-linkerd-identity                               9d
-linkerd-linkerd-proxy-injector                         9d
-linkerd-destination-policy                             9d
+linkerd-linkerd-destination       9d
+linkerd-linkerd-identity          9d
+linkerd-linkerd-proxy-injector    9d
+linkerd-destination-policy        9d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterrolebindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ServiceAccounts exist {#l5d-existence-sa}
 
 Example failure:
@@ -283,6 +299,8 @@ Example failure:
 
 Ensure the Linkerd ServiceAccounts exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get serviceaccounts
 NAME                     SECRETS   AGE
@@ -293,14 +311,20 @@ linkerd-identity         1         14m
 linkerd-proxy-injector   1         14m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts in the Linkerd
 namespace:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n linkerd auth can-i create serviceaccounts
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane CustomResourceDefinitions exist {#l5d-existence-crd}
 
 Example failure:
@@ -313,19 +337,27 @@ Example failure:
 
 Ensure the Linkerd CRD exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get customresourcedefinitions
 NAME                         CREATED AT
 serviceprofiles.linkerd.io   2019-04-25T21:47:31Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create CRDs:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create customresourcedefinitions
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane MutatingWebhookConfigurations exist {#l5d-existence-mwc}
 
 Example failure:
@@ -338,18 +370,26 @@ Example failure:
 
 Ensure the Linkerd MutatingWebhookConfigurations exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get mutatingwebhookconfigurations | grep linkerd
 linkerd-proxy-injector-webhook-config   2019-07-01T13:13:26Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create MutatingWebhookConfigurations:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create mutatingwebhookconfigurations
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ValidatingWebhookConfigurations exist {#l5d-existence-vwc}
 
 Example failure:
@@ -362,18 +402,26 @@ Example failure:
 
 Ensure the Linkerd ValidatingWebhookConfiguration exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get validatingwebhookconfigurations | grep linkerd
 linkerd-sp-validator-webhook-config   2019-07-01T13:13:26Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ValidatingWebhookConfigurations:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create validatingwebhookconfigurations
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ proxy-init container runs as root if docker container runtime is used {#l5d-proxy-init-run-as-root}
 
 Example failure:
@@ -393,7 +441,7 @@ Newer distributions of managed k8s use containerd where this is not an issue.
 
 Without root in the init container you might get errors such as:
 
-```bash
+```text {class=disable-copy}
 time="2021-11-15T04:41:31Z" level=info msg="iptables-save -t nat"
 Error: exit status 1
 time="2021-11-15T04:41:31Z" level=info msg="iptables-save v1.8.7 (legacy): Cannot initialize: Permission denied (you must be root)\n\n"
@@ -417,19 +465,27 @@ Example failure:
 
 Ensure the Linkerd ConfigMap exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get configmap/linkerd-config
 NAME             DATA   AGE
 linkerd-config   3      61m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ConfigMaps:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n linkerd auth can-i create configmap
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane replica sets are ready {#l5d-existence-replicasets}
 
 This failure occurs when one of Linkerd's ReplicaSets fails to schedule a pod.
@@ -779,6 +835,8 @@ Example failure:
 
 Verify the state of the control plane pods with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get po
 NAME                                      READY   STATUS    RESTARTS   AGE
@@ -787,6 +845,8 @@ linkerd-identity-54df78c479-hbh5m         2/2     Running   0          12m
 linkerd-proxy-injector-67f8cf65f7-4tvt5   2/2     Running   1          12m
 ```
 
+{{< /command-output >}}
+
 ### √ cluster networks can be verified {#l5d-cluster-networks-verified}
 
 Example failure:
@@ -861,11 +921,15 @@ Example failure:
 Ensure you can connect to the Linkerd version check endpoint from the
 environment the `linkerd` cli is running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ curl "https://versioncheck.linkerd.io/version.json?version=edge-19.1.2&uuid=test-uuid&source=cli"
 {"stable":"stable-2.1.0","edge":"edge-19.1.2"}
 ```
 
+{{< /command-output >}}
+
 ### √ cli is up-to-date {#l5d-version-cli}
 
 Example failures:
@@ -1109,7 +1173,7 @@ extension binaries implement it. For more information, See
 
 Example error:
 
-```bash
+```text {class=disable-copy}
 invalid extension check output from \"viz\" (JSON object expected)
 ```
 
@@ -1148,19 +1212,27 @@ Example error:
 
 Ensure that the linkerd-cni-config ConfigMap exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get cm linkerd-cni-config -n linkerd-cni
 NAME                      PRIV    CAPS   SELINUX    RUNASUSER   FSGROUP    SUPGROUP   READONLYROOTFS   VOLUMES
 linkerd-linkerd-cni-cni   false          RunAsAny   RunAsAny    RunAsAny   RunAsAny   false            hostPath,secret
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ConfigMaps:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ConfigMaps
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ClusterRole exist {#cni-plugin-cr-exists}
 
 Example error:
@@ -1173,19 +1245,27 @@ Example error:
 
 Ensure that the cluster role exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrole linkerd-cni
 NAME          AGE
 linkerd-cni   54m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ClusterRoleBinding exist {#cni-plugin-crb-exists}
 
 Example error:
@@ -1198,19 +1278,27 @@ Example error:
 
 Ensure that the cluster role binding exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebinding linkerd-cni
 NAME          AGE
 linkerd-cni   54m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoleBindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ServiceAccount exists {#cni-plugin-sa-exists}
 
 Example error:
@@ -1223,19 +1311,27 @@ Example error:
 
 Ensure that the CNI service account exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get ServiceAccount linkerd-cni -n linkerd-cni
 NAME          SECRETS   AGE
 linkerd-cni   1         45m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccount:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ServiceAccounts -n linkerd-cni
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin DaemonSet exists {#cni-plugin-ds-exists}
 
 Example error:
@@ -1248,19 +1344,27 @@ Example error:
 
 Ensure that the CNI daemonset exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get ds -n linkerd-cni
 NAME          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                 AGE
 linkerd-cni   1         1         1       1            1           beta.kubernetes.io/os=linux   14m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create DaemonSets:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create DaemonSets -n linkerd-cni
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin pod is running on all nodes {#cni-plugin-ready}
 
 Example failure:
@@ -1273,6 +1377,8 @@ Example failure:
 
 Ensure that all the CNI pods are running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get po -n linkerd-cni
 NAME                READY   STATUS    RESTARTS   AGE
@@ -1281,8 +1387,12 @@ linkerd-cni-mf564   1/1     Running   0          9m22s
 linkerd-cni-p5670   1/1     Running   0          9m25s
 ```
 
+{{< /command-output >}}
+
 Ensure that all pods have finished the deployment of the CNI config and binary:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl logs linkerd-cni-rzp2q -n linkerd-cni
 Wrote linkerd CNI binaries to /host/opt/cni/bin
@@ -1290,6 +1400,8 @@ Created CNI config /host/etc/cni/net.d/10-kindnet.conflist
 Done configuring CNI. Sleep=true
 ```
 
+{{< /command-output >}}
+
 ## The "linkerd-multicluster checks {#l5d-multicluster}
 
 These checks run if the service mirroring controller has been installed.
@@ -1311,12 +1423,16 @@ Example error:
 Make sure multicluster extension is correctly installed and that the
 `links.multicluster.linkerd.io` CRD is present.
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get crds | grep multicluster
 NAME                              CREATED AT
 links.multicluster.linkerd.io     2021-03-10T09:58:10Z
 ```
 
+{{< /command-output >}}
+
 ### √ Link resources are valid {#l5d-multicluster-links-are-valid}
 
 Example error:
@@ -1401,6 +1517,8 @@ the rules section.
 
 Expected rules for `linkerd-service-mirror-access-local-resources` cluster role:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl  --context=local get clusterrole linkerd-service-mirror-access-local-resources -o yaml
 kind: ClusterRole
@@ -1432,8 +1550,12 @@ rules:
   - watch
 ```
 
+{{< /command-output >}}
+
 Expected rules for `linkerd-service-mirror-read-remote-creds` role:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl  --context=local get role linkerd-service-mirror-read-remote-creds -n linkerd-multicluster  -o yaml
 kind: Role
@@ -1453,6 +1575,8 @@ metadata:
   - watch
 ```
 
+{{< /command-output >}}
+
 ### √ service mirror controllers are running {#l5d-multicluster-service-mirror-running}
 
 Example error:
@@ -1467,12 +1591,16 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the controller pod with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl --all-namespaces get po --selector linkerd.io/control-plane-component=linkerd-service-mirror
-NAME                                  READY     STATUS    RESTARTS   AGE
+NAME                                      READY     STATUS    RESTARTS   AGE
 linkerd-service-mirror-7bb8ff5967-zg265   2/2       Running   0          50m
 ```
 
+{{< /command-output >}}
+
 ### √ extension is managing controllers {#l5d-multicluster-managed-controllers}
 
 Example error:
@@ -1613,22 +1741,30 @@ Example failure:
 
 Ensure the linkerd-viz extension ClusterRoles exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterroles | grep linkerd-viz
-linkerd-linkerd-viz-metrics-api                                        2021-01-26T18:02:17Z
-linkerd-linkerd-viz-prometheus                                         2021-01-26T18:02:17Z
-linkerd-linkerd-viz-tap                                                2021-01-26T18:02:17Z
-linkerd-linkerd-viz-tap-admin                                          2021-01-26T18:02:17Z
-linkerd-linkerd-viz-web-check                                          2021-01-26T18:02:18Z
+linkerd-linkerd-viz-metrics-api    2021-01-26T18:02:17Z
+linkerd-linkerd-viz-prometheus     2021-01-26T18:02:17Z
+linkerd-linkerd-viz-tap            2021-01-26T18:02:17Z
+linkerd-linkerd-viz-tap-admin      2021-01-26T18:02:17Z
+linkerd-linkerd-viz-web-check      2021-01-26T18:02:18Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterroles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ linkerd-viz ClusterRoleBindings exist {#l5d-viz-crb-exists}
 
 Example failure:
@@ -1641,23 +1777,31 @@ Example failure:
 
 Ensure the linkerd-viz extension ClusterRoleBindings exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebindings | grep linkerd-viz
-linkerd-linkerd-viz-metrics-api                        ClusterRole/linkerd-linkerd-viz-metrics-api                                        18h
-linkerd-linkerd-viz-prometheus                         ClusterRole/linkerd-linkerd-viz-prometheus                                         18h
-linkerd-linkerd-viz-tap                                ClusterRole/linkerd-linkerd-viz-tap                                                18h
-linkerd-linkerd-viz-tap-auth-delegator                 ClusterRole/system:auth-delegator                                                  18h
-linkerd-linkerd-viz-web-admin                          ClusterRole/linkerd-linkerd-viz-tap-admin                                          18h
-linkerd-linkerd-viz-web-check                          ClusterRole/linkerd-linkerd-viz-web-check                                          18h
+linkerd-linkerd-viz-metrics-api           ClusterRole/linkerd-linkerd-viz-metrics-api    18h
+linkerd-linkerd-viz-prometheus            ClusterRole/linkerd-linkerd-viz-prometheus     18h
+linkerd-linkerd-viz-tap                   ClusterRole/linkerd-linkerd-viz-tap            18h
+linkerd-linkerd-viz-tap-auth-delegator    ClusterRole/system:auth-delegator              18h
+linkerd-linkerd-viz-web-admin             ClusterRole/linkerd-linkerd-viz-tap-admin      18h
+linkerd-linkerd-viz-web-check             ClusterRole/linkerd-linkerd-viz-web-check      18h
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterrolebindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ viz extension proxies are healthy {#l5d-viz-proxy-healthy}
 
 This error indicates that the proxies running in the viz extension are not
@@ -1742,6 +1886,8 @@ requirements in the cluster:
 
 Ensure all the linkerd-viz pods are injected
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                                   READY   STATUS    RESTARTS   AGE
@@ -1750,9 +1896,11 @@ metrics-api-77f684f7c7-hnw8r   2/2     Running   2          18h
 prometheus-5f6898ff8b-s6rjc    2/2     Running   2          18h
 tap-59f5595fc7-ttndp           2/2     Running   2          18h
 web-78d6588d4-pn299            2/2     Running   2          18h
-tap-injector-566f7ff8df-vpcwc          2/2     Running   2          18h
+tap-injector-566f7ff8df-vpcwc  2/2     Running   2          18h
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`
 
@@ -1766,6 +1914,8 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Ensure all the linkerd-viz pods are running with 2/2
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                                   READY   STATUS    RESTARTS   AGE
@@ -1777,6 +1927,8 @@ web-78d6588d4-pn299                    2/2     Running   2          18h
 tap-injector-566f7ff8df-vpcwc          2/2     Running   2          18h
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`
 
@@ -1790,16 +1942,34 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Ensure all the prometheus related resources are present and running correctly.
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get deploy,cm | grep prometheus
-deployment.apps/prometheus     1/1     1            1           3m18s
-configmap/prometheus-config   1      3m18s
+deployment.apps/prometheus    1/1    1    1    3m18s
+configmap/prometheus-config   1    3m18s
+```
+
+{{< /command-output >}}
+
+{{< command-output "You should see something similar to:" >}}
+
+```bash
 $ kubectl get clusterRoleBindings | grep prometheus
-linkerd-linkerd-viz-prometheus                         ClusterRole/linkerd-linkerd-viz-prometheus                         3m37s
+linkerd-linkerd-viz-prometheus    ClusterRole/linkerd-linkerd-viz-prometheus    3m37s
+```
+
+{{< /command-output >}}
+
+{{< command-output "You should see something similar to:" >}}
+
+```bash
 $ kubectl get clusterRoles | grep prometheus
-linkerd-linkerd-viz-prometheus                                         2021-02-26T06:03:11Zh
+linkerd-linkerd-viz-prometheus    2021-02-26T06:03:11Zh
 ```
 
+{{< /command-output >}}
+
 ### √ can initialize the client {#l5d-viz-existence-client}
 
 Example failure:
@@ -1811,6 +1981,8 @@ Example failure:
 
 Verify that the metrics API pod is running correctly
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                           READY   STATUS    RESTARTS   AGE
@@ -1822,6 +1994,8 @@ grafana-76fd8765f4-9rg8q       2/2     Running   0          4m58s
 prometheus-7c5c48c466-jc27g    2/2     Running   0          4m58s
 ```
 
+{{< /command-output >}}
+
 ### √ viz extension self-check {#l5d-viz-metrics-api}
 
 Example failure:
@@ -1841,8 +2015,7 @@ kubectl -n linkerd-viz logs deploy/metrics-api metrics-api
 
 Example failure:
 
-```bash
-
+```text {class=disable-copy}
 ‼ prometheus is authorized to scrape data plane pods
     prometheus may not be authorized to scrape the following pods:
         * emojivoto/voting-5f46cbcdc6-p5dhn
@@ -1937,11 +2110,15 @@ curl https://buoyant.cloud/install | sh
 Ensure you can connect to the Linkerd Buoyant version check endpoint from the
 environment the `linkerd` cli is running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ curl https://buoyant.cloud/version.json
 {"linkerd-buoyant":"v0.4.4"}
 ```
 
+{{< /command-output >}}
+
 ### √ linkerd-buoyant cli is up-to-date
 
 ```text {class=disable-copy}
@@ -2002,19 +2179,27 @@ linkerd-buoyant install | kubectl apply -f -
 
 Ensure that the cluster role exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrole buoyant-cloud-agent
 NAME                  CREATED AT
 buoyant-cloud-agent   2020-11-13T00:59:50Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent ClusterRoleBinding exists
 
 ```text {class=disable-copy}
@@ -2025,19 +2210,27 @@ yes
 
 Ensure that the cluster role binding exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebinding buoyant-cloud-agent
 NAME                  ROLE                              AGE
 buoyant-cloud-agent   ClusterRole/buoyant-cloud-agent   301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoleBindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent ServiceAccount exists
 
 ```text {class=disable-copy}
@@ -2048,19 +2241,27 @@ yes
 
 Ensure that the service account exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get serviceaccount buoyant-cloud-agent
 NAME                  SECRETS   AGE
 buoyant-cloud-agent   1         301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud auth can-i create ServiceAccount
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-id Secret exists
 
 ```text {class=disable-copy}
@@ -2071,19 +2272,27 @@ yes
 
 Ensure that the secret exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get secret buoyant-cloud-id
 NAME               TYPE     DATA   AGE
 buoyant-cloud-id   Opaque   4      301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud auth can-i create ServiceAccount
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent Deployment exists
 
 ```text {class=disable-copy}
@@ -2117,12 +2326,16 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the `buoyant-cloud-agent` Deployment with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-agent
 NAME                                   READY   STATUS    RESTARTS   AGE
 buoyant-cloud-agent-6b8c6888d7-htr7d   2/2     Running   0          156m
 ```
 
+{{< /command-output >}}
+
 Check the agent's logs with:
 
 ```bash
@@ -2140,12 +2353,16 @@ kubectl logs -n buoyant-cloud buoyant-cloud-agent-6b8c6888d7-htr7d buoyant-cloud
 Ensure the `buoyant-cloud-agent` pod is injected, the `READY` column should show
 `2/2`:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-agent
 NAME                                   READY   STATUS    RESTARTS   AGE
 buoyant-cloud-agent-6b8c6888d7-htr7d   2/2     Running   0          161m
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`.
 
@@ -2159,12 +2376,16 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Check the version with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ linkerd-buoyant version
 CLI version:   v0.4.4
 Agent version: v0.4.4
 ```
 
+{{< /command-output >}}
+
 To update to the latest version:
 
 ```bash
@@ -2218,6 +2439,8 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the `buoyant-cloud-metrics` DaemonSet with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-metrics
 NAME                          READY   STATUS    RESTARTS   AGE
@@ -2227,6 +2450,8 @@ buoyant-cloud-metrics-qtflh   2/2     Running   0          164m
 buoyant-cloud-metrics-wqs4k   2/2     Running   0          163m
 ```
 
+{{< /command-output >}}
+
 Check the agent's logs with:
 
 ```bash
@@ -2244,6 +2469,8 @@ kubectl logs -n buoyant-cloud buoyant-cloud-metrics-kt9mv buoyant-cloud-metrics
 Ensure the `buoyant-cloud-metrics` pods are injected, the `READY` column should
 show `2/2`:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-metrics
 NAME                          READY   STATUS    RESTARTS   AGE
@@ -2253,6 +2480,8 @@ buoyant-cloud-metrics-qtflh   2/2     Running   0          166m
 buoyant-cloud-metrics-wqs4k   2/2     Running   0          166m
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`.
 
@@ -2266,11 +2495,15 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Check the version with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get daemonset/buoyant-cloud-metrics -o jsonpath='{.metadata.labels}'
 {"app.kubernetes.io/name":"metrics","app.kubernetes.io/part-of":"buoyant-cloud","app.kubernetes.io/version":"v0.4.4"}
 ```
 
+{{< /command-output >}}
+
 To update to the latest version:
 
 ```bash
diff --git a/linkerd.io/content/docs/tasks/troubleshooting.md b/linkerd.io/content/docs/tasks/troubleshooting.md
index c574f7b2ce..a9081f9e9b 100644
--- a/linkerd.io/content/docs/tasks/troubleshooting.md
+++ b/linkerd.io/content/docs/tasks/troubleshooting.md
@@ -229,21 +229,29 @@ Example failure:
 
 Ensure the Linkerd ClusterRoles exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterroles | grep linkerd
-linkerd-linkerd-destination                                            9d
-linkerd-linkerd-identity                                               9d
-linkerd-linkerd-proxy-injector                                         9d
-linkerd-policy                                                         9d
+linkerd-linkerd-destination       9d
+linkerd-linkerd-identity          9d
+linkerd-linkerd-proxy-injector    9d
+linkerd-policy                    9d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterroles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ClusterRoleBindings exist {#l5d-existence-crb}
 
 Example failure:
@@ -256,21 +264,29 @@ Example failure:
 
 Ensure the Linkerd ClusterRoleBindings exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebindings | grep linkerd
-linkerd-linkerd-destination                            9d
-linkerd-linkerd-identity                               9d
-linkerd-linkerd-proxy-injector                         9d
-linkerd-destination-policy                             9d
+linkerd-linkerd-destination       9d
+linkerd-linkerd-identity          9d
+linkerd-linkerd-proxy-injector    9d
+linkerd-destination-policy        9d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterrolebindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ServiceAccounts exist {#l5d-existence-sa}
 
 Example failure:
@@ -283,6 +299,8 @@ Example failure:
 
 Ensure the Linkerd ServiceAccounts exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get serviceaccounts
 NAME                     SECRETS   AGE
@@ -293,14 +311,20 @@ linkerd-identity         1         14m
 linkerd-proxy-injector   1         14m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts in the Linkerd
 namespace:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n linkerd auth can-i create serviceaccounts
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane CustomResourceDefinitions exist {#l5d-existence-crd}
 
 Example failure:
@@ -313,19 +337,27 @@ Example failure:
 
 Ensure the Linkerd CRD exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get customresourcedefinitions
 NAME                         CREATED AT
 serviceprofiles.linkerd.io   2019-04-25T21:47:31Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create CRDs:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create customresourcedefinitions
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane MutatingWebhookConfigurations exist {#l5d-existence-mwc}
 
 Example failure:
@@ -338,18 +370,26 @@ Example failure:
 
 Ensure the Linkerd MutatingWebhookConfigurations exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get mutatingwebhookconfigurations | grep linkerd
 linkerd-proxy-injector-webhook-config   2019-07-01T13:13:26Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create MutatingWebhookConfigurations:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create mutatingwebhookconfigurations
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane ValidatingWebhookConfigurations exist {#l5d-existence-vwc}
 
 Example failure:
@@ -362,18 +402,26 @@ Example failure:
 
 Ensure the Linkerd ValidatingWebhookConfiguration exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get validatingwebhookconfigurations | grep linkerd
 linkerd-sp-validator-webhook-config   2019-07-01T13:13:26Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ValidatingWebhookConfigurations:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create validatingwebhookconfigurations
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ proxy-init container runs as root if docker container runtime is used {#l5d-proxy-init-run-as-root}
 
 Example failure:
@@ -393,7 +441,7 @@ Newer distributions of managed k8s use containerd where this is not an issue.
 
 Without root in the init container you might get errors such as:
 
-```bash
+```text {class=disable-copy}
 time="2021-11-15T04:41:31Z" level=info msg="iptables-save -t nat"
 Error: exit status 1
 time="2021-11-15T04:41:31Z" level=info msg="iptables-save v1.8.7 (legacy): Cannot initialize: Permission denied (you must be root)\n\n"
@@ -417,19 +465,27 @@ Example failure:
 
 Ensure the Linkerd ConfigMap exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get configmap/linkerd-config
 NAME             DATA   AGE
 linkerd-config   3      61m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ConfigMaps:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n linkerd auth can-i create configmap
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ control plane replica sets are ready {#l5d-existence-replicasets}
 
 This failure occurs when one of Linkerd's ReplicaSets fails to schedule a pod.
@@ -779,6 +835,8 @@ Example failure:
 
 Verify the state of the control plane pods with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd get po
 NAME                                      READY   STATUS    RESTARTS   AGE
@@ -787,6 +845,8 @@ linkerd-identity-54df78c479-hbh5m         2/2     Running   0          12m
 linkerd-proxy-injector-67f8cf65f7-4tvt5   2/2     Running   1          12m
 ```
 
+{{< /command-output >}}
+
 ### √ cluster networks can be verified {#l5d-cluster-networks-verified}
 
 Example failure:
@@ -861,11 +921,15 @@ Example failure:
 Ensure you can connect to the Linkerd version check endpoint from the
 environment the `linkerd` cli is running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ curl "https://versioncheck.linkerd.io/version.json?version=edge-19.1.2&uuid=test-uuid&source=cli"
 {"stable":"stable-2.1.0","edge":"edge-19.1.2"}
 ```
 
+{{< /command-output >}}
+
 ### √ cli is up-to-date {#l5d-version-cli}
 
 Example failures:
@@ -1109,7 +1173,7 @@ extension binaries implement it. For more information, See
 
 Example error:
 
-```bash
+```text {class=disable-copy}
 invalid extension check output from \"viz\" (JSON object expected)
 ```
 
@@ -1148,19 +1212,27 @@ Example error:
 
 Ensure that the linkerd-cni-config ConfigMap exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get cm linkerd-cni-config -n linkerd-cni
 NAME                      PRIV    CAPS   SELINUX    RUNASUSER   FSGROUP    SUPGROUP   READONLYROOTFS   VOLUMES
 linkerd-linkerd-cni-cni   false          RunAsAny   RunAsAny    RunAsAny   RunAsAny   false            hostPath,secret
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ConfigMaps:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ConfigMaps
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ClusterRole exist {#cni-plugin-cr-exists}
 
 Example error:
@@ -1173,19 +1245,27 @@ Example error:
 
 Ensure that the cluster role exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrole linkerd-cni
 NAME          AGE
 linkerd-cni   54m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ClusterRoleBinding exist {#cni-plugin-crb-exists}
 
 Example error:
@@ -1198,19 +1278,27 @@ Example error:
 
 Ensure that the cluster role binding exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebinding linkerd-cni
 NAME          AGE
 linkerd-cni   54m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoleBindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin ServiceAccount exists {#cni-plugin-sa-exists}
 
 Example error:
@@ -1223,19 +1311,27 @@ Example error:
 
 Ensure that the CNI service account exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get ServiceAccount linkerd-cni -n linkerd-cni
 NAME          SECRETS   AGE
 linkerd-cni   1         45m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccount:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ServiceAccounts -n linkerd-cni
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin DaemonSet exists {#cni-plugin-ds-exists}
 
 Example error:
@@ -1248,19 +1344,27 @@ Example error:
 
 Ensure that the CNI daemonset exists in the CNI namespace:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get ds -n linkerd-cni
 NAME          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                 AGE
 linkerd-cni   1         1         1       1            1           beta.kubernetes.io/os=linux   14m
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create DaemonSets:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create DaemonSets -n linkerd-cni
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ cni plugin pod is running on all nodes {#cni-plugin-ready}
 
 Example failure:
@@ -1273,6 +1377,8 @@ Example failure:
 
 Ensure that all the CNI pods are running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get po -n linkerd-cni
 NAME                READY   STATUS    RESTARTS   AGE
@@ -1281,8 +1387,12 @@ linkerd-cni-mf564   1/1     Running   0          9m22s
 linkerd-cni-p5670   1/1     Running   0          9m25s
 ```
 
+{{< /command-output >}}
+
 Ensure that all pods have finished the deployment of the CNI config and binary:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl logs linkerd-cni-rzp2q -n linkerd-cni
 Wrote linkerd CNI binaries to /host/opt/cni/bin
@@ -1290,6 +1400,8 @@ Created CNI config /host/etc/cni/net.d/10-kindnet.conflist
 Done configuring CNI. Sleep=true
 ```
 
+{{< /command-output >}}
+
 ## The "linkerd-multicluster checks {#l5d-multicluster}
 
 These checks run if the service mirroring controller has been installed.
@@ -1311,12 +1423,16 @@ Example error:
 Make sure multicluster extension is correctly installed and that the
 `links.multicluster.linkerd.io` CRD is present.
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get crds | grep multicluster
 NAME                              CREATED AT
 links.multicluster.linkerd.io     2021-03-10T09:58:10Z
 ```
 
+{{< /command-output >}}
+
 ### √ Link resources are valid {#l5d-multicluster-links-are-valid}
 
 Example error:
@@ -1401,6 +1517,8 @@ the rules section.
 
 Expected rules for `linkerd-service-mirror-access-local-resources` cluster role:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl  --context=local get clusterrole linkerd-service-mirror-access-local-resources -o yaml
 kind: ClusterRole
@@ -1432,8 +1550,12 @@ rules:
   - watch
 ```
 
+{{< /command-output >}}
+
 Expected rules for `linkerd-service-mirror-read-remote-creds` role:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl  --context=local get role linkerd-service-mirror-read-remote-creds -n linkerd-multicluster  -o yaml
 kind: Role
@@ -1453,6 +1575,8 @@ metadata:
   - watch
 ```
 
+{{< /command-output >}}
+
 ### √ service mirror controllers are running {#l5d-multicluster-service-mirror-running}
 
 Example error:
@@ -1467,12 +1591,16 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the controller pod with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl --all-namespaces get po --selector linkerd.io/control-plane-component=linkerd-service-mirror
-NAME                                  READY     STATUS    RESTARTS   AGE
+NAME                                      READY     STATUS    RESTARTS   AGE
 linkerd-service-mirror-7bb8ff5967-zg265   2/2       Running   0          50m
 ```
 
+{{< /command-output >}}
+
 ### √ extension is managing controllers {#l5d-multicluster-managed-controllers}
 
 Example error:
@@ -1613,22 +1741,30 @@ Example failure:
 
 Ensure the linkerd-viz extension ClusterRoles exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterroles | grep linkerd-viz
-linkerd-linkerd-viz-metrics-api                                        2021-01-26T18:02:17Z
-linkerd-linkerd-viz-prometheus                                         2021-01-26T18:02:17Z
-linkerd-linkerd-viz-tap                                                2021-01-26T18:02:17Z
-linkerd-linkerd-viz-tap-admin                                          2021-01-26T18:02:17Z
-linkerd-linkerd-viz-web-check                                          2021-01-26T18:02:18Z
+linkerd-linkerd-viz-metrics-api    2021-01-26T18:02:17Z
+linkerd-linkerd-viz-prometheus     2021-01-26T18:02:17Z
+linkerd-linkerd-viz-tap            2021-01-26T18:02:17Z
+linkerd-linkerd-viz-tap-admin      2021-01-26T18:02:17Z
+linkerd-linkerd-viz-web-check      2021-01-26T18:02:18Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterroles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ linkerd-viz ClusterRoleBindings exist {#l5d-viz-crb-exists}
 
 Example failure:
@@ -1641,23 +1777,31 @@ Example failure:
 
 Ensure the linkerd-viz extension ClusterRoleBindings exist:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebindings | grep linkerd-viz
-linkerd-linkerd-viz-metrics-api                        ClusterRole/linkerd-linkerd-viz-metrics-api                                        18h
-linkerd-linkerd-viz-prometheus                         ClusterRole/linkerd-linkerd-viz-prometheus                                         18h
-linkerd-linkerd-viz-tap                                ClusterRole/linkerd-linkerd-viz-tap                                                18h
-linkerd-linkerd-viz-tap-auth-delegator                 ClusterRole/system:auth-delegator                                                  18h
-linkerd-linkerd-viz-web-admin                          ClusterRole/linkerd-linkerd-viz-tap-admin                                          18h
-linkerd-linkerd-viz-web-check                          ClusterRole/linkerd-linkerd-viz-web-check                                          18h
+linkerd-linkerd-viz-metrics-api           ClusterRole/linkerd-linkerd-viz-metrics-api    18h
+linkerd-linkerd-viz-prometheus            ClusterRole/linkerd-linkerd-viz-prometheus     18h
+linkerd-linkerd-viz-tap                   ClusterRole/linkerd-linkerd-viz-tap            18h
+linkerd-linkerd-viz-tap-auth-delegator    ClusterRole/system:auth-delegator              18h
+linkerd-linkerd-viz-web-admin             ClusterRole/linkerd-linkerd-viz-tap-admin      18h
+linkerd-linkerd-viz-web-check             ClusterRole/linkerd-linkerd-viz-web-check      18h
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create clusterrolebindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ viz extension proxies are healthy {#l5d-viz-proxy-healthy}
 
 This error indicates that the proxies running in the viz extension are not
@@ -1742,6 +1886,8 @@ requirements in the cluster:
 
 Ensure all the linkerd-viz pods are injected
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                                   READY   STATUS    RESTARTS   AGE
@@ -1750,9 +1896,11 @@ metrics-api-77f684f7c7-hnw8r   2/2     Running   2          18h
 prometheus-5f6898ff8b-s6rjc    2/2     Running   2          18h
 tap-59f5595fc7-ttndp           2/2     Running   2          18h
 web-78d6588d4-pn299            2/2     Running   2          18h
-tap-injector-566f7ff8df-vpcwc          2/2     Running   2          18h
+tap-injector-566f7ff8df-vpcwc  2/2     Running   2          18h
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`
 
@@ -1766,6 +1914,8 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Ensure all the linkerd-viz pods are running with 2/2
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                                   READY   STATUS    RESTARTS   AGE
@@ -1777,6 +1927,8 @@ web-78d6588d4-pn299                    2/2     Running   2          18h
 tap-injector-566f7ff8df-vpcwc          2/2     Running   2          18h
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`
 
@@ -1790,16 +1942,34 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Ensure all the prometheus related resources are present and running correctly.
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get deploy,cm | grep prometheus
-deployment.apps/prometheus     1/1     1            1           3m18s
-configmap/prometheus-config   1      3m18s
+deployment.apps/prometheus    1/1    1    1    3m18s
+configmap/prometheus-config   1    3m18s
+```
+
+{{< /command-output >}}
+
+{{< command-output "You should see something similar to:" >}}
+
+```bash
 $ kubectl get clusterRoleBindings | grep prometheus
-linkerd-linkerd-viz-prometheus                         ClusterRole/linkerd-linkerd-viz-prometheus                         3m37s
+linkerd-linkerd-viz-prometheus    ClusterRole/linkerd-linkerd-viz-prometheus    3m37s
+```
+
+{{< /command-output >}}
+
+{{< command-output "You should see something similar to:" >}}
+
+```bash
 $ kubectl get clusterRoles | grep prometheus
-linkerd-linkerd-viz-prometheus                                         2021-02-26T06:03:11Zh
+linkerd-linkerd-viz-prometheus    2021-02-26T06:03:11Zh
 ```
 
+{{< /command-output >}}
+
 ### √ can initialize the client {#l5d-viz-existence-client}
 
 Example failure:
@@ -1811,6 +1981,8 @@ Example failure:
 
 Verify that the metrics API pod is running correctly
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n linkerd-viz get pods
 NAME                           READY   STATUS    RESTARTS   AGE
@@ -1822,6 +1994,8 @@ grafana-76fd8765f4-9rg8q       2/2     Running   0          4m58s
 prometheus-7c5c48c466-jc27g    2/2     Running   0          4m58s
 ```
 
+{{< /command-output >}}
+
 ### √ viz extension self-check {#l5d-viz-metrics-api}
 
 Example failure:
@@ -1841,8 +2015,7 @@ kubectl -n linkerd-viz logs deploy/metrics-api metrics-api
 
 Example failure:
 
-```bash
-
+```text {class=disable-copy}
 ‼ prometheus is authorized to scrape data plane pods
     prometheus may not be authorized to scrape the following pods:
         * emojivoto/voting-5f46cbcdc6-p5dhn
@@ -1937,11 +2110,15 @@ curl https://buoyant.cloud/install | sh
 Ensure you can connect to the Linkerd Buoyant version check endpoint from the
 environment the `linkerd` cli is running:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ curl https://buoyant.cloud/version.json
 {"linkerd-buoyant":"v0.4.4"}
 ```
 
+{{< /command-output >}}
+
 ### √ linkerd-buoyant cli is up-to-date
 
 ```text {class=disable-copy}
@@ -2002,19 +2179,27 @@ linkerd-buoyant install | kubectl apply -f -
 
 Ensure that the cluster role exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrole buoyant-cloud-agent
 NAME                  CREATED AT
 buoyant-cloud-agent   2020-11-13T00:59:50Z
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoles:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoles
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent ClusterRoleBinding exists
 
 ```text {class=disable-copy}
@@ -2025,19 +2210,27 @@ yes
 
 Ensure that the cluster role binding exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl get clusterrolebinding buoyant-cloud-agent
 NAME                  ROLE                              AGE
 buoyant-cloud-agent   ClusterRole/buoyant-cloud-agent   301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ClusterRoleBindings:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl auth can-i create ClusterRoleBindings
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent ServiceAccount exists
 
 ```text {class=disable-copy}
@@ -2048,19 +2241,27 @@ yes
 
 Ensure that the service account exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get serviceaccount buoyant-cloud-agent
 NAME                  SECRETS   AGE
 buoyant-cloud-agent   1         301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud auth can-i create ServiceAccount
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-id Secret exists
 
 ```text {class=disable-copy}
@@ -2071,19 +2272,27 @@ yes
 
 Ensure that the secret exists:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get secret buoyant-cloud-id
 NAME               TYPE     DATA   AGE
 buoyant-cloud-id   Opaque   4      301d
 ```
 
+{{< /command-output >}}
+
 Also ensure you have permission to create ServiceAccounts:
 
+{{< command-output "You should see:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud auth can-i create ServiceAccount
 yes
 ```
 
+{{< /command-output >}}
+
 ### √ buoyant-cloud-agent Deployment exists
 
 ```text {class=disable-copy}
@@ -2117,12 +2326,16 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the `buoyant-cloud-agent` Deployment with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-agent
 NAME                                   READY   STATUS    RESTARTS   AGE
 buoyant-cloud-agent-6b8c6888d7-htr7d   2/2     Running   0          156m
 ```
 
+{{< /command-output >}}
+
 Check the agent's logs with:
 
 ```bash
@@ -2140,12 +2353,16 @@ kubectl logs -n buoyant-cloud buoyant-cloud-agent-6b8c6888d7-htr7d buoyant-cloud
 Ensure the `buoyant-cloud-agent` pod is injected, the `READY` column should show
 `2/2`:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-agent
 NAME                                   READY   STATUS    RESTARTS   AGE
 buoyant-cloud-agent-6b8c6888d7-htr7d   2/2     Running   0          161m
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`.
 
@@ -2159,12 +2376,16 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Check the version with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ linkerd-buoyant version
 CLI version:   v0.4.4
 Agent version: v0.4.4
 ```
 
+{{< /command-output >}}
+
 To update to the latest version:
 
 ```bash
@@ -2218,6 +2439,8 @@ Note, it takes a little bit for pods to be scheduled, images to be pulled and
 everything to start up. If this is a permanent error, you'll want to validate
 the state of the `buoyant-cloud-metrics` DaemonSet with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-metrics
 NAME                          READY   STATUS    RESTARTS   AGE
@@ -2227,6 +2450,8 @@ buoyant-cloud-metrics-qtflh   2/2     Running   0          164m
 buoyant-cloud-metrics-wqs4k   2/2     Running   0          163m
 ```
 
+{{< /command-output >}}
+
 Check the agent's logs with:
 
 ```bash
@@ -2244,6 +2469,8 @@ kubectl logs -n buoyant-cloud buoyant-cloud-metrics-kt9mv buoyant-cloud-metrics
 Ensure the `buoyant-cloud-metrics` pods are injected, the `READY` column should
 show `2/2`:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-metrics
 NAME                          READY   STATUS    RESTARTS   AGE
@@ -2253,6 +2480,8 @@ buoyant-cloud-metrics-qtflh   2/2     Running   0          166m
 buoyant-cloud-metrics-wqs4k   2/2     Running   0          166m
 ```
 
+{{< /command-output >}}
+
 Make sure that the `proxy-injector` is working correctly by running
 `linkerd check`.
 
@@ -2266,11 +2495,15 @@ Make sure that the `proxy-injector` is working correctly by running
 
 Check the version with:
 
+{{< command-output "You should see something similar to:" >}}
+
 ```bash
 $ kubectl -n buoyant-cloud get daemonset/buoyant-cloud-metrics -o jsonpath='{.metadata.labels}'
 {"app.kubernetes.io/name":"metrics","app.kubernetes.io/part-of":"buoyant-cloud","app.kubernetes.io/version":"v0.4.4"}
 ```
 
+{{< /command-output >}}
+
 To update to the latest version:
 
 ```bash
diff --git a/linkerd.io/content/tests/shortcodes.md b/linkerd.io/content/tests/shortcodes.md
index 6f1396f06f..57dc97d961 100644
--- a/linkerd.io/content/tests/shortcodes.md
+++ b/linkerd.io/content/tests/shortcodes.md
@@ -7,6 +7,17 @@ title: Shortcodes
 
 <div class="container-lg" style="display:flex;flex-direction:column;gap:24px;padding:80px 0;">
 
+## command-output
+
+{{< command-output label="You should see:" prompt="%" >}}
+
+```bash
+% linkerd version --client
+Client version: edge-26.6.3
+```
+
+{{< /command-output >}}
+
 ## keyval
 
 {{< keyval >}}
diff --git a/linkerd.io/layouts/_shortcodes/command-output.html b/linkerd.io/layouts/_shortcodes/command-output.html
new file mode 100644
index 0000000000..3b159b232b
--- /dev/null
+++ b/linkerd.io/layouts/_shortcodes/command-output.html
@@ -0,0 +1,41 @@
+{{- $label := cond .IsNamedParams (.Get "label") (.Get 0) | default "Example output:" -}}
+{{- $prompt := "$ " -}}
+{{- /* Get content and remove all whitespace outside of the code fence */ -}}
+{{- $inner := trim .Inner "\n\r\t " -}}
+{{- /* Split code fence into an array of lines */ -}}
+{{- $lines := split $inner "\n" -}}
+{{- /* Get the language from the first line */ -}}
+{{- $lang := strings.TrimPrefix "```" (index $lines 0) -}}
+{{- /* Get all lines between the code fence */ -}}
+{{- $body := first (sub (len $lines) 2) (after 1 $lines) -}}
+{{- /* Seperate command and output into their own arrays */ -}}
+{{- $command := slice -}}
+{{- $output := slice -}}
+{{- $outputFound := false -}}
+{{- range $body -}}
+  {{- if and (not $outputFound) (hasPrefix . $prompt) -}}
+    {{- $command = $command | append (strings.TrimPrefix $prompt .) -}}
+  {{- else -}}
+    {{- $outputFound = true -}}
+    {{- $output = $output | append . -}}
+  {{- end -}}
+{{- end -}}
+{{- /* Only set the lang of the output to plaintext if a command was found */ -}}
+{{- /* NOTE: code fence options are preserved on the command code block, but are not passed to the output code block */ -}}
+{{- $outputLang := cond (gt (len $command) 0) "plaintext {class=disable-copy}" $lang }}
+{{- /* Output */ -}}
+<div class="command-output">
+  {{- with $command }}
+  <div class="command-output__command">
+  {{ printf "```%s\n%s\n```" $lang (delimit . "\n") | $.Page.RenderString }}
+  </div>
+  {{- end }}
+  {{- if and $command $output }}
+  {{ printf `<div class="command-output__label">%s</div>` $label | safeHTML }}
+  {{- end }}
+  {{- with $output }}
+  <div class="command-output__output">
+  {{ printf "```%s\n%s\n```" $outputLang (delimit . "\n") | $.Page.RenderString }}
+  </div>
+  {{- end }}
+</div>

From 59a9175f1bc6736843b16ea3b52621ebbec12528 Mon Sep 17 00:00:00 2001
From: Travis Beckham <travis@buoyant.io>
Date: Mon, 6 Jul 2026 16:03:22 -0500
Subject: [PATCH 2/3] Revert whitespace

Signed-off-by: Travis Beckham <travis@buoyant.io>
---
 linkerd.io/assets/scss/base/_base.scss | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linkerd.io/assets/scss/base/_base.scss b/linkerd.io/assets/scss/base/_base.scss
index 24aa8576c2..f3f529673a 100644
--- a/linkerd.io/assets/scss/base/_base.scss
+++ b/linkerd.io/assets/scss/base/_base.scss
@@ -114,7 +114,7 @@ blockquote {
   border-left: solid 4px abstracts.$blue;
   background-color: abstracts.$light-blue;
   border-radius: abstracts.$border-radius;
-
+  
   & > :last-child {
     margin-bottom: 0;
   }

From 1972a33252ea2432a93bf6e071e41c1a26e25554 Mon Sep 17 00:00:00 2001
From: Travis Beckham <travis@buoyant.io>
Date: Mon, 6 Jul 2026 16:25:44 -0500
Subject: [PATCH 3/3] Fix broken test

Signed-off-by: Travis Beckham <travis@buoyant.io>
---
 linkerd.io/content/tests/shortcodes.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linkerd.io/content/tests/shortcodes.md b/linkerd.io/content/tests/shortcodes.md
index 57dc97d961..9d02b5ecbe 100644
--- a/linkerd.io/content/tests/shortcodes.md
+++ b/linkerd.io/content/tests/shortcodes.md
@@ -9,10 +9,10 @@ title: Shortcodes
 
 ## command-output
 
-{{< command-output label="You should see:" prompt="%" >}}
+{{< command-output "You should see:" >}}
 
 ```bash
-% linkerd version --client
+$ linkerd version --client
 Client version: edge-26.6.3
 ```