Deep Dive: Linkerd
summary
Linkerd 2 deploys a tiny Go control plane with a Rust sidecar proxy and uses a mutating webhook to inject proxies into pods, offering automatic mutual TLS where each proxy generates a key, posts a CSR tied to the pod service account, and rotates certs ~20 hours, keys kept in memory. Observability comes from a bundled Prometheus scrape, per-path service profiles, a latency-aware PG/CPQ load balancer, on-demand tap sampling, HTTP/1↔HTTP/2 proxying between peers, and an extensible Tower library stack.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:20Brief History
- 4:10Where Linkerd is Used
- 5:00Ground Rules
- 5:26Quick Overview
- 5:49GitHub repo
- 7:42Data plane
- 8:05Tower
- 9:15Topology
- 10:33Proxy Injection
- 12:06Automatic Mutual TLS
- 18:35HTTP Requests
- 20:55Service Profiles
- 26:37End Point Stack
- 30:31Service Mesh Interface
- 32:30Lincolni
- 33:31QA
related talks
04mInterview
35mNavigating the Service Mesh Ecosystem
30mService Mesh Is Still Hard. The Things we all Did Wrong & Tales of Woe
35mUpgrading Your Service Mesh to Linkerd 2
27mService Mess to Service Mesh
34mFrom Monolith to Microservices with Kubernetes and Linkerd
38mAsk Me Anything About Service Mesh
34mService Mess to Service Mesh