Linkerd: Lightweight Kubernetes Service Mesh

Linkerd

Linkerd is a service mesh for Kubernetes built around simplicity, security by default, and low overhead. It injects a small, purpose-built proxy written in Rust — the linkerd2-proxy — next to each application container. With nothing more than an annotation, services get mutual TLS, golden metrics (success rate, request rate, latency) for every route, latency-aware load balancing, retries, and timeouts. Linkerd was the first service mesh to graduate in the CNCF.

Where Istio offers a very broad feature set, Linkerd deliberately does less, aiming for a mesh that small platform teams can operate confidently. Understanding its release model and certificate management is as important as understanding its features.

TL;DR

Linkerd adds a Rust micro-proxy sidecar per pod, configured by a small control plane.
Enable it with the linkerd.io/inject: enabled annotation on namespaces or workloads.
mTLS is on by default for meshed TCP traffic; identities derive from Kubernetes service accounts.
You must manage the trust anchor and issuer certificates — typically with cert-manager in production.
Authorization policy uses Server, AuthorizationPolicy, and authentication resources; routing uses Gateway API HTTPRoute.
Open-source releases are edge builds; stable releases come from Buoyant's enterprise distribution.

Quick Example

Install and verify Linkerd, mesh a namespace, and view golden metrics:

Allow only the checkout service to call the orders service:

Core Concepts

Architecture

Security and Certificates

Each proxy receives a short-lived certificate for its workload's service account, issued by the identity component from an issuer certificate, which chains to a trust anchor. The CLI can generate these for trials, but they expire; production installations supply their own and rotate the issuer automatically, commonly with cert-manager. Expired certificates break mesh traffic — monitor them.

Observability

Every meshed request is measured by the proxy, so success rate, requests per second, and latency percentiles are available per deployment, route, and edge between services without application changes. linkerd viz stat, top, routes, and tap expose them live, and Prometheus can scrape the same metrics.

Reliability Features

Load balancing uses an exponentially weighted moving average of latency, sending less traffic to slow endpoints.
Retries and timeouts are configured per route through HTTPRoute annotations or resources; retries apply to requests marked as retryable.
Traffic splitting for canaries uses Gateway API HTTPRoute weights.
Circuit breaking and failure accrual stop sending traffic to repeatedly failing endpoints.

Authorization Policy

By default, meshed workloads accept traffic from anyone. A Server resource describes a port on a set of pods; AuthorizationPolicy resources attach to Servers or routes and require authentication — mesh identities (MeshTLSAuthentication) or network ranges (NetworkAuthentication). Default policies per namespace or cluster can switch to deny-by-default once explicit policies exist.

Releases and Licensing

Since 2024, the Linkerd open-source project publishes edge releases frequently, while stable releases with long-term support are distributed by Buoyant as Buoyant Enterprise for Linkerd, which is free for smaller organizations and paid for larger ones. Teams should decide deliberately whether to track edge releases, with their faster upgrade cadence, or use the enterprise distribution.

Best Practices

Bring Your Own Trust Anchor

Generate a long-lived trust anchor stored securely, issue shorter-lived issuer certificates from it with cert-manager, and alert well before any certificate expires.

Mesh Gradually

Inject one namespace at a time, compare golden metrics before and after, and confirm that health checks, jobs, and non-HTTP protocols behave correctly.

Use Policy in Audit First

Start with an audit default policy to see which connections would be denied, then tighten to deny-by-default with explicit AuthorizationPolicy resources.

Watch Proxy Resources

The proxy is small, but at scale its CPU and memory add up. Set proxy resource requests and limits through annotations where defaults do not fit.

Common Mistakes

Production on CLI-Generated Certificates

Forgetting to Restart Pods

Deny-by-Default Without Inventory

FAQ

What is Linkerd?

A lightweight service mesh for Kubernetes that adds mutual TLS, golden metrics, retries, timeouts, and traffic splitting to services through a small Rust proxy injected next to each application container.

How is Linkerd different from Istio?

Linkerd focuses on simplicity, low resource use, and secure defaults with a narrower feature set. Istio offers more traffic-management and extensibility features, plus an ambient sidecar-less mode, at the cost of more complexity.

Is Linkerd free?

The open-source project and its edge releases are free under the Apache 2.0 license. Stable releases are distributed by Buoyant, free for smaller organizations and paid above a size threshold.

Does Linkerd encrypt traffic automatically?

Yes. Traffic between meshed pods is automatically protected with mutual TLS. Traffic to or from unmeshed workloads is not, so enroll both sides.

How do I do a canary release with Linkerd?

Use a Gateway API HTTPRoute with weighted backend references to split traffic between stable and canary Services, often automated by a progressive delivery tool such as Flagger or Argo Rollouts.