linkerd/linkerd2

Features

• Service Mesh Control Planes - Acts as a control plane that manages service-to-service communication, mutual TLS encryption, and traffic routing.
• Service Meshes - Provides observability, security, and reliability for Kubernetes microservices through transparent sidecar proxies.
• Service Traffic Routing - Implements dynamic traffic shifting for canary and blue-green deployments to manage service releases.
• Service Mesh Networking - Manages service-to-service communication, observability, and security within a cluster using transparent sidecar proxies.
• Service Meshes - Exposes connection errors between microservices by intercepting and reporting communication issues that would otherwise remain invisible.
• Mutual TLS Authentication - Provides trust anchors and issuer keys to establish secure, encrypted communication channels between services.
• Mutual TLS Implementations - Enforces mutual TLS for all inter-service communication by automatically issuing and rotating short-lived cryptographic certificates.
• Zero Trust Networking - Enforces mutual TLS encryption and granular authorization policies to secure network traffic between microservices.
• Service Meshes - Provides a service mesh control plane that orchestrates sidecar proxies for observability, security, and reliable microservice communication.
• Microservice Traffic Management - Implements advanced routing, load balancing, retries, and circuit breaking for distributed microservice traffic.
• Service Proxies - Adds a sidecar proxy to Kubernetes workloads to intercept and manage network traffic automatically during deployment.
• Multi-Cluster Service Connectivity - Links multiple Kubernetes clusters to enable unified service discovery and secure communication across network boundaries.
• Authorization Policies - Validates incoming requests against defined security rules to restrict access based on identity and attributes.
• Cross-Cluster Security - Enables secure, verified communication across distinct network environments.
• Identity-Based Authentication - Ensures secure service communication by verifying the identity of incoming requests.
• Trust Anchor Management - Establishes the trusted identity foundation required for encrypted service-to-service communication.
• Service Communication Security - Secures TCP traffic between pods by automatically establishing mutually-authenticated connections using short-lived certificates.
• Monitoring and Observability - Collects and visualizes real-time telemetry, request metrics, and distributed traces for microservice communication.
• Topology Visualizers - Generates real-time dependency graphs showing service connections automatically.
• Control Planes - Decouples administrative management logic from application workloads to provide centralized infrastructure oversight.
• Failure Simulation Tools - Simulates network failures or increased error rates for specific services to verify system resilience without modifying application code.
• Service Discovery - Resolves destination addresses from service registries to automatically route traffic to backend instances.
• Manifest Generators - Produces configuration files to deploy the service mesh control plane.
• Traffic Management - Implements circuit breaking, retries, and timeouts to prevent cascading failures and improve the resilience of service-to-service communication.
• External Workload Connectors - Connects services running outside of Kubernetes to the service mesh for unified discovery.
• Network Traffic Management - Monitors and applies security policies to traffic originating from the cluster and destined for external networks.
• Network Policy Enforcement - Sets cluster-wide security postures to automatically deny or allow traffic to ports lacking explicit configurations.
• Injection Enforcement - Ensures infrastructure-level security policies are applied by preventing unmanaged services from running.
• Admission Webhooks - Intercepts cluster resource creation requests to automatically inject sidecar proxies into application pods without manual configuration changes.
• Traffic Interception - Redirects inbound and outbound TCP traffic through a sidecar proxy to enable transparent observability, security, and reliability.
• Circuit Breakers - Prevents cascading failures by automatically stopping requests to services that are experiencing high error rates.
• Certificate Lifecycle Management - Automates the rotation of identity issuer certificates and maintains trust bundles for secure communication.
• Granular Access Controls - Manages granular service-to-service communication by defining authorized servers and specific HTTP routes.
• Traffic Routing Engines - Directs HTTP and gRPC requests to specific backend services based on request properties like headers, methods, or URL patterns.
• Automated Certificate Rotation - The service mesh updates expired root or issuer certificates to restore secure communication within the service mesh and ensures all workloads are synchronized with the new trust bundle.
• Request Traffic Monitors - Tracks inbound and outbound request metrics including success rates, latency, and throughput for individual services and API routes.
• Observability Platforms - Provides a platform for collecting metrics, logs, and traces to monitor microservice performance and health.
• Service Dependency Mapping - Generates visual representations of service interactions to help identify communication patterns and architectural relationships within a cluster.
• Infrastructure and Orchestration - Service mesh for Kubernetes and microservices.
• Service Discovery and Mesh - Service mesh for Kubernetes-based infrastructure.
• Request Retries - Automatically re-sends requests that receive transient error responses to improve overall success rates.
• Fault Injection Testing - Redirects a portion of service-to-service requests to a custom backend to simulate failures, timeouts, or errors for resilience testing.
• Service Health Monitoring - Tracks request volume, success rates, and latency distributions to provide visibility into service health and reliability.
• Multicluster Service Meshes - Distributes traffic across service replicas in multiple clusters by treating them as a single logical service.
• Rate Limiters - Caps the number of incoming requests per client to protect services from overload and ensure fair resource distribution.
• Sidecar Proxies - Intercepts pod creation requests to automatically inject sidecar proxies based on resource annotations.
• Traffic Load Balancers - Distributes network traffic across service endpoints in different clusters to ensure high availability.
• Traffic Throttling - Limits the rate of incoming requests to a service at the proxy level to prevent overload and ensure consistent resource availability.
• Service Mirroring Controllers - Exposes services to remote clusters by synchronizing endpoints across network boundaries.
• Egress Controllers - Enforces granular policies on outbound traffic to block unauthorized external connections.
• TLS Termination - Allows the mesh to provide metrics and secure communication for internal requests after external termination.
• TCP Proxies - Routes network connections between services transparently, automatically detecting HTTP protocols or falling back to opaque TCP.
• Traffic Routing - Directs network traffic to specific services using proxy configurations and protocol-aware routing logic.
• Automated Secret Rotation - Automates the update of security certificates for control plane and webhook components to maintain encrypted communication.
• Credential Rotators - Updates trust anchors and identity issuer certificates for service-to-service communication without causing downtime.
• gRPC Security - Enforces fine-grained authentication and authorization policies on inbound gRPC traffic.
• Access Control and Authorization - Grants service accounts permission to access protected network resources based on verified identity.
• Connection Auditing - Inspects service-to-service network connections to verify that mutual TLS is active and identify the specific identities used for communication.
• Route-Based Restrictions - Controls access to individual service endpoints based on HTTP methods and paths.
• Service Access Restrictions - Controls inbound traffic to pods by enforcing authentication requirements based on identity and network origin.
• Performance Visualization - Displays real-time golden metrics including success rates, request volume, and latency.
• Service Connectivity Monitoring - Displays the network topology and communication paths between resources and proxy identities within the cluster.
• Service Discovery & Observability - Provides real-time monitoring and visual dashboards to track service-to-service communication and performance metrics within the cluster.
• Service Metrics Monitoring - Tracks success rates, request volume, and latency percentiles for individual services to identify performance bottlenecks.
• Failure Isolation Mechanisms - Tracks consecutive request failures to individual service instances and temporarily removes them from load balancing pools to prevent cascading failures.
• Graceful Shutdowns - Coordinates the termination of service proxies to ensure active network requests complete before the container shuts down.
• High Availability Services - Configures resource limits and replicas to ensure control plane stability and resilience.
• Load Shedding Systems - Rejects incoming requests with error codes when internal dispatch queues reach capacity to prevent system-wide failure.
• Mesh Traffic Policy Management - Sets baseline access rules for clusters and workloads to determine default traffic handling.
• Inbound Proxy Permissions - Ensures service-to-service communication remains functional by allowing traffic to proxy ports within network policies.
• Network Traffic Controllers - Enforces security and monitoring policies on traffic leaving the cluster to external destinations.
• Version Managers - Updates control plane components by modifying version references in configuration files.
• Distributed Trace Propagation - Maintains and propagates trace context headers across service boundaries to ensure requests are correctly linked.
• Distributed Tracing - Forwards request span data to external collectors to visualize service-to-service communication latency and flow.
• Latency-Aware - Distributes network requests across available service endpoints by dynamically measuring response times to optimize overall system performance.
• Socket-Level Balancers - Configures network plugins to preserve service IP information on packets for accurate routing.
• Access Restrictions - Enforces authorization policies on direct cross-cluster traffic to verify client identity and block unauthorized connections.
• Disconnection Management - Removes cross-cluster communication links by deleting service mirrors and authentication credentials.
• Mirroring Exports - Ensures only explicitly labeled services are discovered and replicated across clusters.
• Protocol Detection - Identifies communication protocols of incoming traffic to enable per-request routing and metrics collection.
• Network Traffic Analyzers - Injects sidecar containers to capture and analyze raw network packets for troubleshooting communication issues.
• Proxy Deployment Tools - Automatically injects data plane proxies into application pods during the deployment phase.
• Network Plugin Installers - Deploys daemonsets to manage network binaries for transparent service communication.
• Authenticated Proxy Exposure - Exports real-time traffic, transport, and security data in standard formats to provide visibility into service-to-service communication and proxy health.
• Traffic Restriction Policies - Prioritizes service endpoints within the same availability zone to minimize cross-zone latency and egress costs.
• Traffic Routing Tools - Enables direct pod-to-pod communication between clusters to improve traffic efficiency and bypass gateways.
• Network-Based Access Controls - Restricts access to services by validating that incoming traffic originates from authorized IP subnets or CIDR ranges.
• TLS Certificate Management - Automates the generation and rotation of TLS certificates for control plane webhooks.
• Certificate Lifecycle Monitors - Reports certificate expiration times and refresh counts to ensure identities remain valid and secure across the service mesh.
• Security Policy Management - Provides centralized management for securing communication between microservices.
• Container Security Hardening - Applies minimally privileged security policies to control plane components to enforce hardened container execution.
• Traffic Inspection Tools - Captures and displays live request data between services in a terminal interface to debug communication patterns.
• Dashboard Interfaces - Provides a web-based dashboard for monitoring service communication and metrics via an ingress controller.
• Identity Certificate Configuration - Establishes a trusted identity foundation for service-to-service communication.
• Cluster Monitoring - Displays performance and traffic statistics for gateways that facilitate communication between linked clusters.
• Metric and Performance Monitors - Collects performance data from sidecar proxies attached to specific workloads to analyze traffic patterns and communication health.
• Proxy Lifecycle Management - Coordinates the startup and shutdown of proxy containers with application containers to ensure correct termination and initialization.
• Request Timeouts - Sets duration limits for client requests and backend communications to ensure timely responses and prevent resource exhaustion.
• Route Performance Metrics - Reports performance statistics for specific service routes when service profiles are defined.
• Traffic Monitoring Tools - Captures and reports metrics for outbound service communication to provide visibility into external traffic patterns and destination hostnames.
• CPU Profilers - Exposes runtime diagnostic data including memory, CPU, and thread usage to identify performance bottlenecks in control plane components.
• Connection Monitors - Tracks TCP connection counts, data throughput, and connection errors to identify network-level issues and resource usage.
• Diagnostic Validators - Inspects installation environments to ensure the service mesh is operating correctly.
• Metrics-Aware Rollbacks - Automatically rolls back service releases when performance metrics degrade.
• Service Mesh Add-ons - Automates the installation and removal of components required for cross-cluster service mirroring and connectivity.
• Annotation-Based Deployment - Uses metadata annotations to trigger automatic network proxy deployment when manifests are applied.
• Policy Auditing - Enables safe policy testing and refinement by monitoring violations without blocking traffic.
• Installation Readiness Diagnostics - The service mesh checks if a specific namespace meets the requirements for installing or running service mesh components before deployment begins.
• Removal Utilities - Generates manifests to completely purge service mesh components from a cluster.
• Protocol Overrides - Explicitly defines communication protocols for services to ensure efficient connection establishment.
• Ingress Controllers - Extends service mesh security and observability features to traffic entering the cluster via existing ingress controllers.
• Local Bypass Configurations - Excludes specific network ports or local loopback traffic from proxy interception to allow direct communication.
• Network Connectivity Configurations - Adjusts the duration that idle or half-closed network connections remain open to prevent premature termination.
• Route Health Analyzers - Inspects the performance and health of specific traffic paths to diagnose issues within individual service endpoints.
• Network Traffic Routing - Offloads network traffic redirection to a cluster-wide plugin to remove pod-level administrative requirements.
• Diagnostic Toolkits - Provides diagnostic tools including request tracing, log level adjustment, and endpoint inspection to identify communication errors.
• Mesh Extensions - Integrates modular components into the existing infrastructure to provide additional functionality such as cross-cluster routing or enhanced observability.
• Traffic Management Gateways - Routes incoming traffic from external gateways into the internal network by inspecting destination headers.
• Policy Auditing - Allows administrators to verify which identities are permitted to communicate with a service.
• Role-Based Access Control - Controls access to traffic monitoring tools using role-based access control.
• Webhook Certificate Rotation - Maintains secure communication between the API server and service mesh components.
• Metric Visualization Tools - Displays real-time and historical service communication data through integrated dashboards.
• Packet Inspection - Captures and analyzes low-level network traffic to confirm that application data is successfully wrapped in encryption.
• Resource Monitoring - Aggregates and displays real-time traffic statistics for specified cluster resources to track performance and health.
• Request Modifiers - Alters request headers and paths for outbound gRPC traffic to support communication requirements.
• Request Loggers - Records details of all HTTP requests passing through the proxy to provide visibility into service-to-service communication patterns.

Star history