Linkerd Technology Expert

Core Architecture

Control Plane:
  destination    -- Service discovery, policy distribution to proxies
  identity       -- Certificate authority, mTLS cert issuance and rotation (24h default)
  proxy-injector -- Mutating webhook, injects linkerd2-proxy sidecar

Data Plane:
  linkerd2-proxy (per pod, Rust sidecar)
  - Ultra-lightweight: ~20-30 MB RAM (vs Envoy's 50 MB+)
  - Purpose-built for service mesh (not a general-purpose proxy)
  - HTTP/1.1, HTTP/2, gRPC, WebSocket, TCP
  - Built-in mTLS, retries, timeouts, circuit breaking, L7 metrics
  - Protocol detection (no manual annotation for HTTP)

Why linkerd2-proxy (Rust)

• Memory: ~20-30 MB per pod vs Envoy's ~50 MB+ (saves 2-3x memory per pod)
• Performance: Lower p99 latency than Envoy (163ms less at 2,000 RPS in independent benchmarks)
• Security: Rust memory safety eliminates buffer overflow vulnerabilities
• Focus: Built only for service mesh, not a general-purpose proxy. Smaller codebase, smaller attack surface.
• Control plane memory: ~200-300 MB vs Istio's 600 MB - 2 GB

Installation

# Install CLI
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh

# Pre-flight check
linkerd check --pre

# Install CRDs
linkerd install --crds | kubectl apply -f -

# Install control plane
linkerd install | kubectl apply -f -

# Verify
linkerd check

# Install extensions
linkerd viz install | kubectl apply -f -          # dashboard + metrics
linkerd multicluster install | kubectl apply -f - # multi-cluster
linkerd jaeger install | kubectl apply -f -       # distributed tracing

Sidecar Injection

# Enable auto-injection for namespace
kubectl annotate namespace production linkerd.io/inject=enabled

# Manual injection
linkerd inject deployment.yaml | kubectl apply -f -

# Verify proxy is running
linkerd check --proxy -n production

# Check meshed pods
linkerd viz stat deployment -n production

mTLS (Zero Configuration)

Linkerd automatically enables mTLS on every TCP connection between meshed workloads. No configuration required.

How It Works

1. identity component issues X.509 certificates to each proxy at startup
2. Certificates use SPIFFE identity format: spiffe://root.linkerd.cluster.local/ns/production/sa/myapp
3. Certificates rotate automatically every 24 hours
4. Both client and server proxies verify certificates -- mutual authentication

Verify mTLS

# Check mTLS status for all edges in namespace
linkerd viz edges deployment -n production

# Live traffic stream showing mTLS status
linkerd viz tap deployment/myapp -n production

# Output shows TLS=true for encrypted connections
# req id=0:0 proxy=in  src=10.1.2.3:54321 dst=10.1.2.4:8080 tls=true :method=GET :path=/api/health

Certificate Management

# Check trust anchor expiry
linkerd check --output json | jq '.categories[] | select(.categoryName == "linkerd-identity")'

# Rotate trust anchor (before expiry)
step certificate create root.linkerd.cluster.local ca.crt ca.key --profile root-ca --no-password --not-after=8760h
linkerd upgrade --identity-trust-anchors-file=ca.crt | kubectl apply -f -

Critical: Trust anchors have a default lifetime of 1 year. Set a calendar reminder to rotate before expiry, or use cert-manager for automatic rotation.

Post-Quantum Cryptography (Linkerd 2.19+)

Linkerd 2.19 (October 2025) introduced ML-KEM-768 hybrid key exchange for mTLS, making it the first production service mesh with post-quantum cryptography.

What This Means

• ML-KEM-768: NIST-standardized post-quantum Key Encapsulation Mechanism
• Hybrid key exchange: Combines ML-KEM-768 with X25519 (classical). If ML-KEM is broken, X25519 still provides security. If X25519 is broken by quantum computers, ML-KEM provides security.
• Forward secrecy: Protects against "harvest now, decrypt later" attacks
• Transparent: No application changes required. Enabled by default in 2.19+.

Performance Impact

• Key exchange size increases by ~1 KB per connection
• Negligible CPU overhead for ML-KEM-768 operations
• Connection establishment takes ~0.5ms longer
• Throughput impact: < 1%

Traffic Management

ServiceProfile (Per-Route Policies)

apiVersion: linkerd.io/v1alpha2