Linkerd

A Kubernetes service mesh that adds mTLS, traffic metrics, and reliability to pod-to-pod traffic through a lightweight Rust sidecar proxy.

• Category: Service Mesh & Networking
• CNCF maturity: Graduated
• Language: Go (control plane and CLI) and Rust (policy controller and data plane proxy)
• License: Apache-2.0
• Repository: linkerd/linkerd2
• Documented at commit: 7977d50 (near tag edge-26.6.3)

What it is

Linkerd is a service mesh for Kubernetes. It runs a small proxy next to each meshed pod and routes that pod's TCP traffic through the proxy. Once traffic flows through the proxies, the mesh gives you mutual TLS between pods, golden metrics (success rate, request rate, latency), retries, and traffic splitting without changing application code.

The project spans two repositories. The control plane and the linkerd CLI live in linkerd/linkerd2 (Go, with a Rust policy controller). The data plane proxy lives in linkerd/linkerd2-proxy, a purpose-built micro-proxy written in Rust (source 6). The defining choice is that proxy: Linkerd does not use Envoy. It ships a small Rust proxy aimed at low latency, low memory, and memory safety (sources 12, 13).

Linkerd was the project that introduced the term "service mesh" (sources 4, 13). It joined the CNCF in 2017 and became the first service mesh to reach Graduated status in 2021 (sources 1, 2).

When to use it

• You run on Kubernetes and want mTLS between services turned on by default with minimal configuration.
• You want golden metrics and traffic-level reliability (retries, timeouts, traffic splits) without editing application code.
• You value a small operational surface: a CLI-driven install, a compact codebase, and a proxy that needs no per-workload tuning.
• It is a weaker fit if you need the full breadth of Istio's feature set or non-Kubernetes workloads, since Linkerd is Kubernetes-focused.
• It is a weaker fit if you want sidecar-free, kernel-level networking, where Cilium's eBPF model is the closer match (source 12).

In this deep-dive

• History: origin, milestones, and why it exists.
• Architecture: components and how requests flow.
• Adoption & Ecosystem: who runs it and what surrounds it.
• Internals: the code paths that matter, read from source.
• Getting Started: install and a first working setup.

Sources

• Source 1: CNCF Announces Linkerd Graduation
• Source 2: Announcing Linkerd's Graduation (linkerd.io)
• Source 3: Linkerd (CNCF projects page)
• Source 4: Linkerd Joins the CNCF (2017)
• Source 5: linkerd/linkerd2 (control plane and CLI)
• Source 6: linkerd/linkerd2-proxy (Rust data plane)
• Source 7: Linkerd 2.x Adopters & Case Studies
• Source 8: ADOPTERS.md (linkerd2)
• Source 9: Linkerd surpasses Istio adoption with 118% growth in 2021
• Source 10: Linkerd 2024 Security Audit
• Source 11: CNCF TAG Contributor Strategy: Linkerd governance review (#648)
• Source 12: Linkerd vs Istio (Buoyant)
• Source 13: What is a service mesh? (linkerd.io)
• Source 14: Imagine Learning highlights Linkerd cost savings (InfoQ)