Linkerd:
├── Control Plane
│   ├── Destination (service discovery)
│   ├── Identity (mTLS certificates)
│   ├── Proxy Injector (sidecar injection)
│   └── Public API (metrics/control)
└── Data Plane
    ├── Linkerd Proxy (Rust-based)
    ├── Init Container (iptables setup)
    └── Proxy Metrics

Key Features:
- Automatic mTLS
- Golden metrics out-of-the-box
- Ultra-lightweight (written in Rust)
- Zero-config service discovery

undefined

**Production Installation:**
```bash

undefined

undefined

**Namespace with Injection:**
```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  annotations:
    linkerd.io/inject: enabled

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
spec:
  template:
    metadata:
      annotations:
        linkerd.io/inject: enabled
    spec:
      containers:
      - name: myapp
        image: myapp:latest

metadata:
  annotations:
    linkerd.io/inject: enabled
    config.linkerd.io/skip-inbound-ports: "8080,8443"
    config.linkerd.io/skip-outbound-ports: "3306,5432"

metadata:
  annotations:
    linkerd.io/inject: enabled
    config.linkerd.io/proxy-cpu-request: "100m"
    config.linkerd.io/proxy-memory-request: "128Mi"
    config.linkerd.io/proxy-cpu-limit: "1000m"
    config.linkerd.io/proxy-memory-limit: "256Mi"
    config.linkerd.io/proxy-log-level: "info,linkerd=debug"

apiVersion: split.smi-spec.io/v1alpha2
kind: TrafficSplit
metadata:
  name: myapp-canary
  namespace: production
spec:
  service: myapp
  backends:
  - service: myapp-v1
    weight: 90
  - service: myapp-v2
    weight: 10
---

**HTTPRoute (Fine-Grained Routing):**
```yaml
apiVersion: policy.linkerd.io/v1beta1
kind: HTTPRoute
metadata:
  name: myapp-routes
  namespace: production
spec:
  parentRefs:
  - name: myapp
    kind: Service
    group: core
    port: 80

  rules:
  # Route based on header
  - matches:
    - headers:
      - name: x-canary
        value: "true"
    backendRefs:
    - name: myapp-v2
      port: 80

  # Route based on path
  - matches:
    - path:
        type: PathPrefix
        value: /api/v2
    backendRefs:
    - name: myapp-v2
      port: 80

  # Default route
  - backendRefs:
    - name: myapp-v1
      port: 80
      weight: 90
    - name: myapp-v2
      port: 80
      weight: 10

apiVersion: policy.linkerd.io/v1alpha1
kind: HTTPRoute
metadata:
  name: myapp-retries
  namespace: production
spec:
  parentRefs:
  - name: myapp
    kind: Service

  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    filters:
    - type: RequestHeaderModifier
      requestHeaderModifier:
        set:
        - name: l5d-retry-http
          value: "5xx"
        - name: l5d-retry-limit
          value: "3"
    backendRefs:
    - name: myapp
      port: 80

apiVersion: policy.linkerd.io/v1alpha1
kind: HTTPRoute
metadata:
  name: myapp-timeouts
  namespace: production
spec:
  parentRefs:
  - name: myapp
    kind: Service

  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    timeouts:
      request: 10s
      backendRequest: 8s
    backendRefs:
    - name: myapp
      port: 80

apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
  name: myapp.production.svc.cluster.local
  namespace: production
spec:
  routes:
  - name: GET /api/users
    condition:
      method: GET
      pathRegex: /api/users
    responseClasses:
    - condition:
        status:
          min: 500
          max: 599
      isFailure: true
    retryBudget:
      retryRatio: 0.2
      minRetriesPerSecond: 10
      ttl: 10s

apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  name: myapp-server
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: myapp
  port: 8080
  proxyProtocol: HTTP/2

apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: myapp-auth
  namespace: production
spec:
  server:
    name: myapp-server

  client:
    # Allow from specific service account
    meshTLS:
      serviceAccounts:
      - name: frontend
        namespace: production

    # Allow unauthenticated (for ingress)
    unauthenticated: true

    # Allow from specific namespaces
    meshTLS:
      identities:
      - "*.production.serviceaccount.identity.linkerd.cluster.local"

undefined

undefined

undefined

**Service Export:**
```yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: production
  labels:
    mirror.linkerd.io/exported: "true"
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080

undefined

**Prometheus Metrics:**
```promql

**Jaeger Integration:**
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: linkerd-config-overrides
  namespace: linkerd
data:
  global: |
    tracing:
      collector:
        endpoint: jaeger.linkerd-jaeger:55678
      sampling:
        rate: 1.0

undefined

**Mesh Operations:**
```bash

**Observability:**
```bash

**Diagnostics:**
```bash

undefined

undefined

undefined

annotations:
  config.linkerd.io/proxy-cpu-limit: "1000m"
  config.linkerd.io/proxy-memory-limit: "256Mi"

undefined

undefined

- Success Rate (requests/sec)
- Request Volume (RPS)
- Latency (P50, P95, P99)

undefined

undefined

undefined

undefined

undefined

undefined

undefined

**2. Skip Ports Unnecessarily:**
```yaml

**3. No Authorization Policies:**
```yaml

**4. Ignoring Metrics:**
```bash

undefined