Linkerd — Ultralight Service Mesh for Kubernetes

Linkerd: Lightweight Service Mesh

Linkerd is an ultralight, security-first service mesh for Kubernetes. It is the original service mesh project and a CNCF graduated project. Linkerd focuses on simplicity and performance, offering the core benefits of a service mesh — mTLS, observability, and reliability — without the operational complexity that comes with heavier alternatives.

Key Features

• Ultralight proxy: Uses a purpose-built Rust proxy (linkerd2-proxy) that consumes far less CPU and memory than Envoy-based meshes
• Automatic mTLS: Zero-configuration mutual TLS between all meshed services, with certificate rotation handled automatically
• Real-time observability: Golden metrics (success rate, RPS, latency) for every service out of the box via the dashboard and CLI
• HTTP/2 and gRPC support: First-class support for modern protocols alongside HTTP/1.1
• Reliability features: Automatic retries, timeouts, and latency-aware load balancing
• Zero-config security: mTLS is on by default without requiring any policy authoring
• Multicluster: Built-in support for extending the mesh across multiple Kubernetes clusters
• Policy: Service authorization policies to restrict which services can communicate

Use Cases

• Quick mTLS adoption: Add encryption and authentication to all inter-service traffic with a single annotation
• Observability without instrumentation: Get request-level metrics for every service without modifying application code
• Reliability for HTTP services: Add automatic retries on idempotent requests and timeouts without code changes
• Low-overhead deployments: Service mesh for resource-constrained environments where Istio’s footprint is prohibitive
• Security hardening: Enforce zero-trust networking with minimal configuration burden on developers

Quick Start

Install Linkerd and inject it into your namespace:

# Install the Linkerd CLI
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh
export PATH=$HOME/.linkerd2/bin:$PATH

# Validate your cluster
linkerd check --pre

# Install Linkerd control plane
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Verify installation
linkerd check

# Install the viz extension for the dashboard
linkerd viz install | kubectl apply -f -
linkerd viz dashboard &

Inject Linkerd sidecar into a deployment:

# Inject via annotation (preferred for GitOps)
kubectl annotate namespace my-namespace \
  linkerd.io/inject=enabled

# Or inject directly into a manifest
kubectl get deploy my-app -o yaml \
  | linkerd inject - \
  | kubectl apply -f -

Check real-time metrics for your services:

# View top-line stats
linkerd viz stat deploy

# Live request-level traffic
linkerd viz tap deploy/my-app

# View routes and success rates
linkerd viz routes deploy/my-app

Add a service authorization policy:

apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  name: my-api
  namespace: my-app
spec:
  podSelector:
    matchLabels:
      app: my-api
  port: 8080
---
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: allow-frontend
  namespace: my-app
spec:
  server:
    name: my-api
  client:
    meshTLS:
      serviceAccounts:
        - name: frontend

Comparison with Alternatives

Feature	Linkerd	Istio	Consul Connect
Proxy	Rust (linkerd2-proxy)	Envoy	Envoy
CPU overhead	Very low	High	Medium
Memory per pod	~10MB	~50-100MB	~30-50MB
Configuration complexity	Low	High	Medium
Traffic management	Basic	Advanced	Good
Non-K8s support	No	Limited	Yes

vs Istio: Linkerd is dramatically simpler to install and operate, with a much lower resource footprint. Istio offers richer traffic management features (complex routing rules, fault injection, traffic mirroring). For teams that need the basics done right with minimal ops burden, Linkerd wins. For advanced traffic engineering, Istio is more capable.

vs Envoy standalone: Envoy is a proxy, not a service mesh. You would need to build significant control-plane tooling to replicate what Linkerd provides out of the box. Linkerd is the ready-to-use solution.

Linkerd is the best starting point for teams new to service meshes, or for organizations that want solid security and observability without committing to heavy operational overhead.