Understanding Linkerd Service Mesh Architecture

At a high level, Linkerd consists of a control plane and a data plane.

Control Plane

The control plane runs a set of services in a dedicated Kubernetes namespace (default linkerd) and provides overall management of Linkerd.

Destination service

Data‑plane proxies use the destination service to obtain service‑discovery information (including TLS identity), policy data (allowable request types), routing metrics, retry and timeout settings, and other configuration needed for request handling.

Identity service

The identity service acts as a TLS certificate authority: it receives CSRs from proxies and returns signed certificates, which are used for mutual TLS (mTLS) between proxies.

Proxy injector

The proxy injector is a Kubernetes admission controller that intercepts each pod creation request. When a pod carries the annotation linkerd.io/inject: enabled, the injector modifies the pod spec to add the proxy‑init and linkerd‑proxy containers along with their startup configuration.

Data Plane

The Linkerd data plane consists of ultra‑lightweight sidecar micro‑proxies deployed as containers inside each application pod. These proxies are installed by linkerd‑init (or Linkerd’s CNI plugin) which creates iptables rules that transparently capture all inbound and outbound TCP connections for the pod.

Linkerd2‑proxy

Implemented in Rust, Linkerd2‑proxy is a purpose‑built micro‑proxy for service‑mesh workloads. Its capabilities include:

Transparent, zero‑configuration proxying for HTTP, HTTP/2, and any TCP protocol.

Automatic Prometheus metric export for HTTP and TCP traffic.

Transparent WebSocket proxying.

Latency‑aware 7‑layer (application‑level) load balancing.

Automatic 4‑layer (transport‑level) load balancing for non‑HTTP traffic.

Automatic TLS termination.

On‑demand diagnostics via the Tap API.

Additional features not listed here.

The proxy also supports service discovery via DNS and a gRPC API.

Linkerd init container

The linkerd‑init container runs as a Kubernetes init container added to every mesh‑enabled pod. It executes before any application containers, configuring iptables to redirect all TCP traffic through the sidecar proxy.

For further reading, see the official Linkerd documentation and blog posts linked in the original article.