Linkerd 2.11 Adds Server Authorization, gRPC Body Retry, and Performance Boosts

Linkerd 2.11 is a stable release that adds several new features and improvements for Kubernetes service‑mesh users.

Authorization Policy

The new server authorization policy lets you control which services may communicate at a fine‑grained level, leveraging the automatic mTLS identities provided by Linkerd. Policies are expressed natively in Kubernetes via annotations, requiring minimal configuration.

Linkerd 2.11 ships a set of default policies that can be applied at the cluster, namespace, or pod level by adding a single Kubernetes annotation. The defaults include: all-authenticated – only requests from mTLS‑validated services are allowed; all-unauthenticated – all requests are allowed; deny – all requests are rejected;

…and additional custom policies.

Two new CRDs, Server and ServerAuthorization, work together to apply policies to any set of pods. For example, a Server can select all pods in a namespace and expose their admin ports, while a ServerAuthorization can permit health‑check connections from the kubelet or metrics‑collection traffic over mTLS.

Retry with Body

Retrying failed requests is a core reliability feature of Linkerd. Previously only body‑less requests such as HTTP GET could be retried for performance reasons. In version 2.11, Linkerd can also retry failed requests that contain a body, including gRPC calls, with a maximum body size of 64KB.

Container Startup Ordering

Linkerd 2.11 ensures that the linkerd2-proxy container becomes ready before any other containers in the pod. This addresses Kubernetes’ lack of native startup ordering and eliminates a class of race conditions where application containers attempt to connect before the proxy is ready.

Smaller, Faster, Lighter

As usual, Linkerd 2.11 continues to make the mesh the lightest and fastest on Kubernetes. Notable changes include:

The control plane is reduced to only 3 deployments.

The data‑plane micro‑proxy, written in Rust, is smaller and faster.

Most SMI functionality has been moved out of the core control plane into extensions.

Linkerd images now use a minimal “distroless” base.

Additional Improvements

New CLI tab‑completion for Kubernetes resources.

Namespace‑wide config.linkerd.io annotations can be set to provide default values for pods created in that namespace.

A short‑output mode for linkerd check -o short.

Dashboard extensions page added.

Fuzz testing for the proxy.

Proxy now adds informational l5d-client-id and l5d-proxy-error headers.

Significant Helm configurability and linkerd‑check enhancements.

Experimental multicluster support for StatefulSets via linkerd-multicluster.

And many other bug fixes and performance tweaks.

For full details, see the official release notes and GitHub tag stable-2.11.0.