Buoyant Blog

Today we're happy to announce Linkerd 2.16, a major step forward for Linkerd that adds a whole host of new features, including support for IPv6; an "audit mode" for Linkerd's zero trust security policies; a new implementation of retries, timeouts, and per-route metrics for HTTPRoute and GPRCRoute resources; and much more.

In this guide we'll walk you through a task that is increasingly common in the Kubernetes space: migrating an existing Istio deployment to Linkerd.

Transitioning core service mesh functionality between Istio and Linkerd is not overly complicated. Chances are you're using Istio for things that Linkerd also supports.

Topology Aware Routing is a feature of Kubernetes that prevents cluster traffic within one availability zone from crossing to another availability zone. For high-traffic applications deployed in multi-zone clusters, this can provide significant cost savings. However, Topology Aware Routing is designed to always prohibit cross-zone traffic, regardless of overall system health or performance.

Today we're happy to announce the release of Buoyant Enterprise for Linkerd 2.15.3. This latest stable release includes several backported bug fixes, especially for native sidecars, as well as introducing usability improvements and new diagnostic and configuration features.

Today, we're happy to announce pod-based pricing for Buoyant Enterprise for Linkerd. This new pricing is designed to give our adopters a clear way and transparent picture of the cost of BEL, to be fair and commensurate with Linkerd's value, and to avoid penalizing specific architectural decisions and technical decisions that are independent of how Linkerd is used.

Today we're happy to announce the release of Buoyant Enterprise for Linkerd 2.15.2. This release makes our high-availability zonal load balancer (HAZL) available in the standard proxy build, and includes several feature improvements and bugfixes, including for a memory leak in the security policy controller.

A few days ago, we announced Linkerd 2.15 with mesh expansion, native sidecars, SPIFFE support, and some other great new features—and also with a statement that we would no longer be publishing open source stable releases. That last point provoked some great discussion on various forums. We knew that there were a lot of Linkerd users out there. We were reminded this week that our users are very, very passionate about the project. Overall feedback was very positive, but we also learned that there are a couple of things that we need to clarify and a few things we need to consider changing.

Today we're happy to announce the release of Linkerd 2.15, which adds support for mesh expansion, native sidecars, and SPIFFE identities, and introduces a new model for stable releases.

Progressive delivery is a vital tool for ensuring that new code is deployed safely to production with automated protections if things go wrong. Tools like Argo, Flux, and even service meshes like Linkerd provide different parts of the puzzle.

Now that we understand what a service mesh is and why you need one, and have deployed it in our environment, we'll focus on a core day two concern: how to effectively monitor your network with the CNCF-graduated service mesh.

We're happy to announce the release of Linkerd 2.14 with improved support for multi-cluster deployments on shared flat networks, full Gateway API conformance, and much more. The new release comes four months after our massive Linkerd 2.13 release with circuit breaking and dynamic request routing and continues Linkerd's focus on coupling enterprise-grade power and flexibility.

If you're using Kubernetes, you've probably heard the term "sidecar" by now. What might surprise you, however, is that Kubernetes itself has no built-in notion of sidecars—at least, until now.

Any organization working in the cloud has to manage multiple, complex challenges to security and reliability, while keeping a tight rein on costs. Your brand’s reputation depends on managing these challenges with aplomb, ensuring that you handle threats and failures quickly, transparently, and efficiently.

Multi-cluster Kubernetes refers to managing multiple Kubernetes clusters, which are groups of nodes working together to orchestrate and run containerized applications. These clusters can be distributed across different data centers, regions, or cloud providers to ensure high availability, fault tolerance, and better performance.

As discussed in my introduction to Linkerd, service meshes provide important, powerful security, reliability, and observability features. And although many engineers shy away from implementing a service mesh due to its perceived complexity, there is no real reason to wait if you use Linkerd.

Over the past years, service mesh adoption has skyrocketed, but the reasons have shifted over time. While service mesh adoption was initially primarily driven by reliability and observability features, today, its ability to implement core security primitives such as mutual TLS and request-level authorization — both big components of a zero trust approach to network security — is the main driver. 

We're excited to announce the launch of our free, self-paced, hands-on Fundamentals of the Service Mesh course! This course is designed for anyone who wants to deepen their understanding of service meshes and get some practical experience deploying Linkerd on a Kubernetes cluster.

In light of the Open Service Mesh team's announcement that OSM will be archived and no further OSM releases will be published, Buoyant, creators of Linkerd, is happy to announce an enterprise migration package for Open Service Mesh customers.

The Linkerd 2.13 release introduces dynamic request routing based on the Gateway API, circuit breaking for overloaded services, and several other important features and fixes.

When you deploy a pod, do you know if your application is running how you want it to? Is its traffic encrypted? Is your application performing as expected? Is it constantly timing out? Constantly retrying? These are all questions you have to ask yourself when running any application in production — containerized or not.

The cloud native ecosystem with Kubernetes at its core has transformed how organizations deploy and operate applications in the cloud. One part of the stack has been getting particular traction from security professionals lately: the service mesh—an infrastructure layer that manages and controls network communication between Kubernetes-based microservices.

Today we're pleased to announce Linkerd 2.12.4, including OpenSSL security updates, fixes for large clusters, and more!

Earlier this week, OpenSSL released a security advisory detailing two high-severity vulnerabilities in certain versions of OpenSSL. After careful investigation, the Buoyant security team has determined that the latest Linkerd releases (2.12, 2.12.1, and 2.12.2) are not vulnerable to the noted exploits, and that no action is required by users of the latest Linkerd releases to mitigate these vulnerabilities in Linkerd.

As the company that coined the service mesh term, we are always keenly interested in understanding where engineers are at in their service mesh adoption. That's why, after surveying KubeCon L.A. attendees last October, we decided to do the same in Valencia. And just as in L.A., we gained some fascinating insights. Here's a snapshot.

Today we’re very happy to announce the release of Linkerd 2.12. This massive release introduces route-based policy to Linkerd, allowing users to define and enforce authorization policies based on HTTP routes in a fully zero-trust way. These policies are built on Linkerd's strong workload identities, secured by mutual TLS, and configured using types from Kubernetes' s new Gateway API.

In the upcoming 2.12 release, Linkerd will take a first step towards adopting the Gateway API as core configuration framework. While this API was originally designed to handle ingress traffic, we believe it has a lot of potential for service meshes as well. In this blog post we'll cover some of our thinking behind this choice and what, if anything, it means for you.

eBPF is cool technology with a lot to offer the cloud native world. It’s been a popular choice for the CNI layer of Kubernetes clusters thanks to projects like Cilium. Service meshes like Linkerd are often deployed with CNI layers like Cilium, combining Linkerd’s powerful L7 processing with Cilium’s …

Last year was a landmark one for the service mesh. Linkerd attained CNCF graduated status, introduced traffic policy, and publicly powered companies like Microsoft and HEB. At KubeCon Los Angeles in November, we conducted a simple survey of attendees to understand the nature of their service mesh...

Securing data in transit and at rest is essential — developers and operators are equally aware of that. Yet, breaches within high-profile companies seem to occur almost daily. Why is that? For once, securing data is a really hard process and the question of who’s responsible for what is not always ...

One of the core goals for Linkerd is to “just work”. This includes running on any modern distribution of Kubernetes. For most Kubernetes environments, that means you don’t have to do anything special to run Linkerd. But OpenShift is a lot more than just vanilla Kubernetes, so we have to make a few

Hands-on, Engineer-focused Training from the Creators of Linkerd Today, we are very excited to announce the launch of Buoyant’s Service Mesh Academy, a hands-on training series designed to provide free education for software engineers around the world on the critical topic of the service mesh. The ...

How do you restrict network traffic between namespaces in a Kubernetes cluster? Whether you’re running a multi-tenant cluster with strict isolation guarantees or simply want to introduce a layer of control, locking down namespaces within a cluster is a common desire for Kubernetes operators. In this...

Getting the best of both worlds Today we’re going to learn about how to combine Emissary ingress (formerly known as the Ambassador API Gateway) with Linkerd to build a scalable system that combines the context-aware routing of Emissary with the observability and security of Linkerd. Emissary is a …

Hello folks and welcome! Today we’re going to talk about GitOps and how it relates to the Linkerd service mesh. GitOps is a buzzy topic, and that’s in no small part because it can have a really positive impact on teams working with Kubernetes. Teams that have established effective GitOps pipelines...

Today, we’re happy to announce that we’ve published our Linkerd Production Runbook, freely available to all. As every SRE knows, the “runbook” for a system is where you capture all the hard-earned advice for operating the system in production. Our Linkerd Production Runbook is a distillation...

In this article we’re going to show you how to accomplish a basic Kubernetes observability task: getting “golden metrics” (or “golden signals”) from the applications running on your Kubernetes cluster. We’ll do this without changing any code or doing any configuration by installing Linkerd, an open...

Applying L4 network policies with a service mesh. In this tutorial, you’ll learn how to run Linkerd and Cilium together and how to use Cilium to apply L3 and L4 network policies to a cluster running Linkerd. Linkerd is an ultralight, open source service mesh. Cilium is an open source CNI layer for...

It’s finally arrived! The CNCF’s Introduction to Service Mesh with Linkerd training course is now available. If you’re new to the service mesh, this course covers everything from basic service mesh concepts to practical implementations of Linkerd in a production environment. The service mesh doesn’t...

SLOs are a lot easier with a service mesh in han. In this tutorial, you’ll learn how to easily create service health SLOs on Kubernetes with Prometheus, an open source time-series database, and Linkerd, an open source ultralight service mesh. You’ll see how using a service mesh can solve one of the...

Service Level Objectives are a hot topic in the world of software reliability. SLOs are usually thought of as a way to balance risk vs. reward for a given application. Should we ship a new feature for this service, even though we might risk an outage? But for Kubernetes adopters, SLOs can provide...

This post is a writeup of a talk I gave last month at KubeCon EU 2020. Introduction In mid-2019, the Linkerd project’s continuous integration (CI) took 45 minutes, all tests were serialized on a single Kubernetes cluster, and multi-hour backups were common. A migration onto one-off Kubernetes in …

As the creators of Linkerd, Buoyant has been, for several years now, in the unique position of helping organizations around the globe adopt the service mesh. From the early days before “service mesh” was even a term, to the latest multi-cluster Kubernetes-based adoption, we’ve seen Linkerd usage...

At the Camp Cloud Native virtual event on June 24, I had the opportunity to talk about how Linkerd 2.8 implements multi-cluster support simply and securely for anyone who needs services to operate reliability across pods, availability zones, or regions. Running multiple production Kubernetes...

Today, the Cloud Native Computing Foundation’s (CNCF) Technical Oversight Committee (TOC) voted to accept Linkerd as its fifth hosted project, alongside Kubernetes, Prometheus, OpenTracing and Fluentd. Linkerd is an open source, resilient ...

Linkerd, our service mesh for cloud-native applications, needs to handle very high volumes of production traffic over extended periods of time. In this post, we’ll describe the load testing strategies and tools we use to ensure Linkerd can meet this goal. We’ll review some of the problems we faced...