linkerd/linkerd

Features

• Sidecar Proxies - Uses a sidecar-proxy architecture to intercept and manage all network traffic for application containers.
• Transparent Network Proxies - Functions as a transparent sidecar proxy that intercepts TCP and application-level traffic without code changes.
• Traffic Resilience Policies - Implements traffic resilience policies including circuit breakers, retries, and timeouts to protect backend services.
• Proxy Node Performance Metrics - Captures latency and throughput data from individual pod proxies to evaluate performance.
• Request Retries - Configures automatic retries and timeouts for requests to improve overall system resilience.
• Kubernetes Service Meshes - Provides a complete service mesh for Kubernetes to manage microservice traffic, reliability, and security.
• Service Mesh Control Planes - Provides a centralized control plane for managing routing policies, service discovery, and security identities.
• Layer 7 Traffic Routing - Performs request-level routing, retries, and telemetry by inspecting HTTP and gRPC headers.
• Access Restrictions - Controls traffic flow to pods by restricting communication based on verified identities or IP addresses.
• Service Discovery Endpoints - Resolves destination endpoints and TLS identities to determine request routing.
• Distributed Observability - Provides distributed observability by analyzing traffic flows across microservices to identify performance bottlenecks.
• Multi-Protocol Routing - Routes multiple protocols between services while applying load balancing and protocol detection.
• Sidecar Proxy Deployments - Injects transparent sidecar proxies into application pods to intercept and manage all network traffic.
• Injection Enforcement - Blocks workload scheduling if the proxy injector is unavailable to prevent traffic bypass.
• Service Discovery - Retrieves internal destination addresses and discovery state to debug network routing.
• Traffic Interception - Redirects TCP traffic through a local sidecar proxy using network rules for transparent interception.
• Transparent Proxy Forwarders - Intercepts network traffic at the system level and forwards incoming requests to the application via the proxy.
• Traffic Routing - Directs HTTP requests to backends based on URL paths, methods, and headers.
• Traffic Routing Controllers - Controls the flow of HTTP and gRPC requests using reverse proxies, load balancing, and custom routing logic.
• Dynamic Routing - Directs requests based on properties or splits traffic for canary and blue-green deployments.
• Layer 4 TCP Routing - Provides transport-layer routing for raw TCP traffic, enabling byte-level metrics and mutual TLS encryption.
• Transparent TCP Proxies - Configures rules in pods to divert TCP traffic through a proxy transparently without modifying application code.
• Inbound Traffic Restrictions - Restricts client requests to pods based on authentication, membership, or explicit denial.
• Authorization Services - Creates and administers rules that control which services are permitted to communicate.
• Mutual TLS Implementations - Establishes cryptographic identities between services using automatic mutual TLS certificate management.
• Request Authorization Enforcers - Validates incoming requests against authorization policies to control access and apply retries.
• Service Communication Security - Implements mutual authentication and encrypted transit between microservices to secure inter-service communication.
• TLS Traffic Encryption - Secures communication between services by automatically managing certificates and encrypting all TCP traffic.
• Pod-to-Pod Encryptions - Automatically applies mutual TLS to all TCP traffic between pods to secure inter-service communication.
• Fine-Grained Access Control - Authorizes traffic to pods by matching clients against verified identities or IP subnets.
• Distributed Tracing - Generates timing data for requests passing through proxies to identify performance bottlenecks.
• Microservice Traffic Monitors - Collects real-time metrics, access logs, and distributed traces to monitor microservice traffic and health.
• HTTP Access Logging - Records all HTTP requests transiting the proxy in standard formats for traffic analysis and auditing.
• Network Protocol Metrics - Exports automatic performance statistics and activity counters for various network protocols.
• Metrics Exporters - Exposes telemetry for all incoming and outgoing proxy traffic for monitoring and analysis.
• Path Performance Monitors - Collects health, latency, and volume data for specific network paths to monitor performance.
• Performance Visualization - Provides visual dashboards for monitoring real-time success rates, request volumes, and latency.
• Service Mesh Observability - Integrates distributed tracing, metrics, and structured logging to provide unified observability for the service mesh.
• Route Performance Metrics - Displays performance and traffic statistics for individual service routes based on defined profiles.
• Transparent Telemetry - Collects telemetry for network traffic between services without changing application code.
• Request Timeouts - Sets maximum durations for requests and backend attempts to prevent hanging connections.
• Diagnostic Validators - Provides diagnostic tools to verify the correctness of the service mesh installation and cluster configuration.
• Endpoint Availability Rejection - Rejects queued requests immediately when a service is marked as unhealthy to avoid unnecessary connection attempts.
• Endpoint Isolation - Implements circuit breaking by isolating backend endpoints that exhibit failure patterns until they recover.
• High Availability Control Planes - Ensures control plane availability by running multiple replicas of critical components across nodes and zones.
• Application-Layer Fault Injection - Enables application-layer fault injection by programmatically increasing service error rates via configuration.
• Controlled Fault Injections - Introduces programmatic network delays and service failures to validate system resilience and recovery.
• Network Faults - Introduces artificial network delays and connectivity disruptions to test the resilience of microservices.
• Local Rate Limiting - Implements local rate limiting within the proxy to protect services from traffic surges and misbehaved clients.
• Multicluster Service Meshes - Provides the framework and components needed to unify multiple clusters into a single service mesh environment.
• Configuration Validation - Performs diagnostic checks to ensure the multicluster extension is operational and correctly configured.
• Federated Traffic Distribution - Balances requests across services with the same name located across multiple distinct clusters.
• Service Profiles - Creates configurations to define how traffic is handled for specific services.
• External Traffic Routing - Integrates with ingress controllers to route external traffic into internal microservices.
• DNS-Based Service Discovery - Resolves destination addresses via DNS and cluster APIs to identify targets for load balancing.
• gRPC Traffic Routing - Matches gRPC requests based on paths, methods, or headers to control traffic distribution.
• gRPC Request Modification - Adjusts headers, paths, and timeouts for proxies acting as gRPC clients.
• Latency-Aware - Distributes requests across service endpoints using a moving average of response times to optimize performance.
• Multi-Cluster Service Connectivity - Links services across multiple Kubernetes clusters into a unified, secure network fabric.
• Service Mirroring Controllers - Supports cross-cluster service mirroring to synchronize endpoints and enable communication across different Kubernetes clusters.
• Protocol Detection - Identifies communication protocols of incoming traffic to enable automatic per-request routing and metrics collection.
• Live Traffic Analysis - Captures and analyzes live network traffic via a command-line interface to debug interactions.
• gRPC Access Control - Applies authentication and authorization policies to specific gRPC routes for pods.
• Network Plugin Installers - Deploys a CNI plugin via DaemonSet to manage networking binaries for transparent traffic proxying.
• Sidecar Injection - Automatically mutates pod specifications via an admission controller to inject proxy sidecars.
• Admission Webhooks - Implements admission webhooks to automatically inject proxy sidecars into pods based on namespace annotations.
• Service Discovery Integrations - Integrates services outside the Kubernetes cluster by defining their identity and addresses for discovery.
• Outbound Request Modification - Alters request paths and adds custom headers to traffic leaving a pod.
• Circuit Breakers - Prevents cascading failures by stopping requests to services that are consistently failing.
• CNI-Based Routing - Installs network routing rules via a CNI plugin to enable transparent proxying without requiring administrative privileges.
• Egress Controls - The service mesh applies policies and routing configurations to egress traffic within the proxy.
• Protocol-Based Routing Rules - Directs network traffic based on specific protocol-based route definitions for fine-grained control.
• Zone-Aware Routing - Directs requests to endpoints within the same availability zone to minimize network latency and transfer costs.
• HTTP Metadata Traffic Filtering - Segments traffic based on paths, headers, or verbs to apply distinct authorization policies.
• Route-Based Authorization - Applies authentication and authorization policies to inbound requests based on route matches.
• Proxy Injection Annotations - Uses specific annotations on resource files to trigger the automatic injection of proxies into pods.
• Resilience Testing - Allows the programmatic injection of service failures to verify system robustness and error recovery.
• Load Shedding - Drops new requests with immediate errors when dispatch queues exceed capacity to maintain system stability.
• Inbound - Controls incoming request flow using a local proxy mechanism to prevent service overload.
• Identity-Based Rate Limiting - Restricts request volume for specific clients based on identity to prevent quota exhaustion.
• Gateway Observability - Provides monitoring and health tracking specifically for gateways routing traffic between clusters.
• Health Metrics Exposure - Exposes internal health and status data from control plane processes for external monitoring.
• Real-Time Traffic Monitoring - Provides real-time traffic data and aggregated statistics for specific network resources.
• Request Stream Monitoring - Listens to live streams of requests for targeted resources to facilitate behavioral debugging.
• Service Dependency Mapping - Visualizes network edges and identities between resources to map service dependencies.
• Service Topology Graphing - Generates live dependency graphs of service traffic to map complex system interactions.
• Monitoring Data Visualization - Displays observability data through visual components to monitor the health of the service mesh.
• Traffic Monitoring Tools - Classifies and visualizes outbound egress traffic using custom resource definitions for network observability.
• Traffic Tapping - Uses a diagnostic tap API to observe real-time requests and responses flowing through the proxy.
• Service Mesh - Resilient service mesh for cloud-native applications.

Istoric stele