Protocol Detection: A Deep Dive into How Linkerd Achieves Zero-Config
Talkat ServiceMeshCon Europe 2022 · on Tuesday, 2022-05-17· at 11:05· Pavilion 3 | Room D | Level 2 | Central Forum·
summary
Linkerd achieves zero-config by peeking connection bytes, using a control-plane Destination service and a 10s detection timeout fallback; older workarounds were skip ports (iptables bypass) or timeouts that cause 10s delays. The implemented solution adds opaque ports with a protocol hint and inbound proxy port so client proxies connect immediately and use transport.l5d.io ALPN to establish mTLS to the peer proxy, delivering observability, request-level routing and golden metrics while keeping non-meshed servers unencrypted.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:10What's the Story Here?
- 4:24What Does Zero-Config Mean?
- 5:35What is Protocol Detection?
- 6:41Why Does Protocol Detection Matter? ?
- 8:24Reliability
- 8:55Security
- 9:23When Does Protocol Detection Fail?
- 21:24How is opaque_transport Used
- 28:01What About Policy?
- 28:45Questions?
related talks
27mThe Future of Linkerd: 2.18 and Beyond
34mLinkerd Deep Dive
25mLinkerd Intro – Andrew Seigner, Buoyant.io, & George Miranda (Any Skill Level)
30mClusterlink: Enabling Fine-Grained and High-Speed Application-Level Connectivity...
34mContainer Networking Untangling Services Meshes and SDNs
26mDisrupting Malicious Traffic with Egress Proxies
25mStretching CNI Boundaries with Service Meshes, a Roadmap for the Future
34mHow Many Proxies Do You Need?