Linkerd: Up and Running: A Guide to Operationalizing a Kubernetes-Native Service Mesh

Preface
   Who Should Read This Book
   Why We Wrote This Book
   Navigating This Book
   Conventions Used in This Book
   Using Code Examples
   O’Reilly Online Learning
   How to Contact Us
   Acknowledgments
1. Service Mesh 101
   Basic Mesh Functionality
      Security
      Reliability
      Observability
   How Do Meshes Actually Work?
   So Why Do We Need This?
   Summary
2. Intro to Linkerd
   Where Does Linkerd Come From?
      Linkerd1
      Linkerd2
      The Linkerd Proxy
   Linkerd Architecture
      mTLS and Certificates
      Certifying Authorities
      The Linkerd Control Plane
      Linkerd Extensions
   Summary
3. Deploying Linkerd
   Considerations
      Linkerd Versioning
      Workloads, Pods, and Services
      TLS certificates
      Linkerd Viz
   Deploying Linkerd
      Required Tools
      Provisioning a Kubernetes Cluster
      Installing Linkerd via the CLI
      Installing Linkerd via Helm
   Configuring Linkerd
      Cluster Networks
      Linkerd Control Plane Resources
      Opaque and Skip Ports
   Summary
4. Adding Workloads to the Mesh
   Workloads Versus Services
   What Does It Mean to Add a Workload to the Mesh?
   Injecting Individual Workloads
   Injecting All Workloads in a Namespace
   linkerd.io/inject Values
   Why Might You Decide Not to Add a Workload to the Mesh?
   Other Proxy Configuration Options
   Protocol Detection
      When Protocol Detection Goes Wrong
      Opaque Ports Versus Skip Ports
      Configuring Protocol Detection
      Default Opaque Ports
   Kubernetes Resource Limits
   Summary
5. Ingress and Linkerd
   Ingress Controllers with Linkerd
   The Ingress Controller Is Just Another Meshed Workload
   Linkerd Is (Mostly) Invisible
      Use Cleartext Within the Cluster
      Route to Services, Not Endpoints
      Ingress Mode
   Specific Ingress Controller Examples
      Emissary-ingress
      NGINX
      Envoy Gateway
   Summary
6. The Linkerd CLI
   Installing the CLI
      Updating the CLI
      Installing a Specific Version
      Alternate Ways to Install
   Using the CLI
   Selected Commands
      linkerd version
      linkerd check
      linkerd inject
      linkerd identity
      linkerd diagnostics
   Summary
7. mTLS, Linkerd, and Certificates
   Secure Communications
      TLS and mTLS
      mTLS and Certificates
      Linkerd and mTLS
   Certificates and Linkerd
      The Linkerd Trust Anchor
      The Linkerd Identity Issuer
      Linkerd Workload Certificates
      Certificate Lifetimes and Rotation
      Certificate Management in Linkerd
      Automatic Certificate Management with cert-manager
   Summary
8. Linkerd Policy: Overview and Server-Based Policy
   Linkerd Policy Overview
      Linkerd Default Policy
      Linkerd Policy Resources
      Server-Based Policy Versus Route-Based Policy
   Server-Based Policy with the emojivoto Application
      Configuring the Default Policy
      Configuring Dynamic Policy
   Summary
9. Linkerd Route-Based Policy
   Route-Based Policy Overview
   The booksapp Sample Application
      Installing booksapp
   Configuring booksapp Policy
      Infrastructure Policy
      Read-Only Access
      Enabling Write Access
      Allowing Writes to books
      Reenabling the Traffic Generator
   Summary
10. Observing Your Platform with Linkerd
   Why Do We Need This?
   How Does Linkerd Help?
   Observability in Linkerd
      Setting Up Your Cluster
      Tap
      Service Profiles
      Topology
   Linkerd Viz
   Audit Trails and Access Logs
      Access Logging: The Good, the Bad, and the Ugly
      Enabling Access Logging
   Summary
11. Ensuring Reliability with Linkerd
   Load Balancing
   Retries
      Retry Budgets
      Configuring Retries
      Configuring the Budget
   Timeouts
      Configuring Timeouts
   Traffic Shifting
      Traffic Shifting, Gateway API, and the Linkerd SMI Extension
      Setting Up Your Environment
      Weight-Based Routing (Canary)
      Header-Based Routing (A/B Testing)
      Traffic Shifting Summary
   Circuit Breaking
      Enabling Circuit Breaking
      Tuning Circuit Breaking
   Summary
12. Multicluster Communication with Linkerd
   Types of Multicluster Setups
      Gateway-Based Multicluster
      Pod-to-Pod Multicluster
      Gateways Versus Pod-to-Pod
   Multicluster Certificates
   Cross-Cluster Service Discovery
   Setting Up for Multicluster
      Continuing with a Gateway-Based Setup
      Continuing with a Pod-to-Pod Setup
      Multicluster Gotchas
   Deploying and Connecting an Application
   Checking Traffic
   Policy in Multicluster Environments
   Summary
13. Linkerd CNI Versus Init Containers
   Kubernetes sans Linkerd
      Nodes, Pods, and More
      Networking in Kubernetes
      The Role of the Packet Filter
      The Container Networking Interface
      The Kubernetes Pod Startup Process
   Kubernetes and Linkerd
      The Init Container Approach
      The Linkerd CNI Plugin Method
      Races and Ordering
   Summary
14. Production-Ready Linkerd
   Linkerd Community Resources
      Getting Help
      Responsible Disclosure
      Kubernetes Compatibility
   Going to Production with Linkerd
      Stable or Edge?
      Preparing Your Environment
      Configuring Linkerd for High Availability
   Monitoring Linkerd
      Certificate Health and Expiration
      Control Plane
      Data Plane
      Metrics Collection
      Linkerd Viz for Production Use
      Accessing Linkerd Logs
   Upgrading Linkerd
      Upgrading via Helm
      Upgrading via the CLI
   Readiness Checklist
   Summary
15. Debugging Linkerd
   Diagnosing Data Plane Issues
      “Common” Linkerd Data Plane Failures
      Setting Proxy Log Levels
   Debugging the Linkerd Control Plane
      Linkerd Control Plane and Availability
      The Core Control Plane
      Linkerd Extensions
   Summary
Index
About the Authors