Prasanta Kumar Behera
Service Mesh — Istio & Linkerd›03 · Linkerd architecture
Learning Hub / Kubernetes & Platform / Service Mesh — Istio & Linkerd

Lesson 03 of 7 · Modules

Linkerd architecture

How Linkerd takes a simplicity-first approach: a small control plane, a purpose-built Rust micro-proxy, mTLS on by default, installing and checking it, the trust anchor and issuer certificates you must manage, the viz extension, and how its release model works.

Advanced
Key wordsLinkerdlinkerd2-proxyRust micro-proxydestinationidentityproxy-injectortrust anchorissuer certificatelinkerd checkviz extensionHTTPRouterelease channels

Simplicity first

Linkerd (a CNCF graduated project) focuses on doing the core mesh jobs with minimal configuration:

  • mTLS on by default between meshed pods.
  • Golden metrics for every meshed workload.
  • Latency-aware load balancing, retries and timeouts.
  • A small control plane and a purpose-built Rust proxy (linkerd2-proxy) instead of a general-purpose one.

If Istio is a Swiss Army knife with a tool for everything, Linkerd is a really good pair of scissors: fewer features, but they're sharp, light and hard to use wrongly. Many teams need scissors more than the whole knife.

Architecture

Component Job
destination Service discovery and routing/policy info for proxies
identity Issues workload certificates (signed by the issuer certificate)
proxy-injector Mutating webhook adding the proxy (and init/CNI) to pods
linkerd2-proxy The data plane, one per meshed pod
Extensions viz (metrics/dashboard), multicluster, jaeger

Install

$ linkerd check --pre
$ linkerd install --crds | kubectl apply -f -
$ linkerd install | kubectl apply -f -
$ linkerd check
$ kubectl annotate namespace shop linkerd.io/inject=enabled
$ kubectl -n shop rollout restart deploy
$ linkerd viz install | kubectl apply -f - && linkerd viz check

For production, install with Helm and supply your own trust anchor and issuer certificates (generated with a tool such as step), rather than letting the CLI generate short-lived ones.

Certificates you own

trust anchor (root CA, long-lived, kept offline/secure)
   └── issuer certificate (intermediate, used by the identity controller)
          └── workload certificates (per proxy, short-lived, auto-rotated)
  • Workload certificates rotate automatically.
  • The issuer can be rotated automatically with cert-manager.
  • The trust anchor must be rotated with a planned procedure before it expires (bundle old + new anchors, roll proxies, remove old). Put its expiry date in monitoring today.

Traffic features

  • Retries and timeouts (configured via Gateway API HTTPRoute annotations/filters in recent versions, or ServiceProfiles in older setups; ServiceProfiles also support retry budgets).
  • Traffic splitting for canaries via Gateway API HTTPRoute weights (lesson 05).
  • Authorization policy resources (Server, AuthorizationPolicy, MeshTLSAuthentication) for identity-based access.

Release model

Linkerd's open-source project publishes frequent edge releases; since 2024, stable release artifacts are distributed by Buoyant (the main maintainer company), free for smaller organisations and under a commercial subscription for larger ones. Check the current terms and choose a channel deliberately before standardising on it.

Try it: Linkerd in 15 minutes

  1. Install the Linkerd CLI, run linkerd check --pre, then install CRDs and the control plane on kind.
  2. Deploy the emojivoto demo app (from the Linkerd docs), annotate its namespace, and restart it.
  3. Install viz and run linkerd viz stat deploy -n emojivoto; find the service with a low success rate.
  4. Use linkerd viz tap to watch the failing requests, and linkerd viz edges to confirm mTLS identities.
  5. Check the issuer and trust anchor expiry (linkerd check warns when they're close) and write a rotation plan.

Going deeper: running Linkerd

  • Install HA mode (multiple control-plane replicas, PDBs) for production.
  • Integrate the issuer with cert-manager, and alert on trust anchor expiry months ahead.
  • For multi-cluster, the multicluster extension mirrors services across clusters with mTLS across gateways (or flat networks).

Recap

  • Linkerd: simplicity-first mesh, Rust micro-proxy, mTLS by default, golden metrics built in.
  • Control plane: destination, identity, proxy-injector; extensions like viz.
  • You own the trust anchor and issuer lifecycles; automate the issuer, plan anchor rotation.
  • Traffic splitting and retries via Gateway API HTTPRoute (or ServiceProfiles); check the release channel terms.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.