What We Learned From the Gateway API: Designing Linkerd’s New Policy CRD
summary
Linkerd implements new resources: Server and ServerAuthorization CRDs that select pods and a single port so authorization attaches to the traffic receiver, not the Service. Linkerd integrates the Gateway API HTTPRoute and adopts the SIG Network policy attachment pattern, shipping pod-level mTLS identity checks and route-scoped allowlists in Linkerd 2.11/2.12. This replaces coarse service profiles with finer-grained retries/timeouts/authorization attached to routes and it works in production setups.
AI-written summary · about
chapters (11)
- 0:00Gateway API project intro
- 1:54Linkerd service mesh basics
- 3:02Authorization challenges in 2.11
- 7:13Server and ServerAuthorization design
- 9:38Gateway API overview
- 12:51Fine-grained HTTP auth
- 15:21Unifying service profiles
- 16:23Advantages of Gateway API
- 19:07Lessons from integration
- 20:51Linkerd learning resources
- 22:09Q&A
related talks
28mOverview and State of Linkerd
30mService Mesh Is Still Hard. The Things we all Did Wrong & Tales of Woe
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
41mEffortless Secure and Control Traffic Using Kubernetes Gateway API for Ingress, Egress an...
52mService Mess to Service Mesh
37mEnforcing Automatic mTLS With Linkerd and OPA Gatekeeper
35mUpgrading Your Service Mesh to Linkerd 2
04mInterview