apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: checksum/config: ae55650be9f3a66e3f923fd0bf8feb16926579a5348ecb5a3e658fc68fbff4e6 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: "2026-06-03T04:03:57Z" generateName: linkerd-destination-5c8c677c54- labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd pod-template-hash: 5c8c677c54 name: linkerd-destination-5c8c677c54-pzknf namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: linkerd-destination-5c8c677c54 uid: 063ed5b1-aab0-4e4c-809e-642a1f08c591 resourceVersion: "959" uid: aefafd37-10c7-4c4d-b66f-00c5d7730688 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: localhost.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: localhost.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8086,8090,8443,9443,9990,9996,9997 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-98d7x readOnly: true - args: - destination - -addr=:8086 - -controller-namespace=linkerd - -enable-h2-upgrade=true - -log-level=info - -log-format=plain - -enable-endpoint-slices=true - -cluster-domain=cluster.local - -identity-trust-domain=cluster.local - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9996 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: destination ports: - containerPort: 8086 name: grpc protocol: TCP - containerPort: 9996 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9996 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-98d7x readOnly: true - args: - sp-validator - -log-level=info - -log-format=plain - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9997 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: sp-validator ports: - containerPort: 8443 name: sp-validator protocol: TCP - containerPort: 9997 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9997 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: sp-tls readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-98d7x readOnly: true - args: - --admin-addr=0.0.0.0:9990 - --control-plane-namespace=linkerd - --grpc-addr=0.0.0.0:8090 - --server-addr=0.0.0.0:9443 - --server-tls-key=/var/run/linkerd/tls/tls.key - --server-tls-certs=/var/run/linkerd/tls/tls.crt - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - --identity-domain=cluster.local - --cluster-domain=cluster.local - --default-policy=all-unauthenticated - --log-level=info - --log-format=plain - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - --probe-networks=0.0.0.0/0 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: admin-http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: policy ports: - containerPort: 8090 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP - containerPort: 9443 name: policy-https protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: admin-http scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: policy-tls readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-98d7x readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-98d7x readOnly: true nodeName: chart-test-swarm-run-18-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-destination serviceAccountName: linkerd-destination terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: sp-tls secret: defaultMode: 420 secretName: linkerd-sp-validator-k8s-tls - name: policy-tls secret: defaultMode: 420 secretName: linkerd-policy-validator-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity - name: kube-api-access-98d7x projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:57Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:57Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:57Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://d9d9a00f8f293f5084fc41d3c656bf915f087495cd7215816d89a078b862f432 image: cr.l5d.io/linkerd/controller:stable-2.14.10 imageID: cr.l5d.io/linkerd/controller@sha256:65bed6a346b259cb1ff04420ee296afa28c38cb3e789ce285e5987f039dddf45 lastState: {} name: destination ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:42Z" - containerID: containerd://bf0a6c47786a5e0f4aa288376c3379a9f72ac9e9548effecff65c197554182ff image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imageID: cr.l5d.io/linkerd/proxy@sha256:7876cee0717575ebc39d2b7cfd701e0df28a809bcb2cf4974716a0bce1ce32cb lastState: {} name: linkerd-proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:02Z" - containerID: containerd://6016b9a24153ce6fc36164edcdb9f211294ea69e6573e00e755aea589bf2ad32 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imageID: cr.l5d.io/linkerd/policy-controller@sha256:763ccb8651e3ba93507732205c18b8dc2d15da94b4f5d04e8683c3f92f0c5ebe lastState: {} name: policy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:43Z" - containerID: containerd://0cc441204ae848baf1c7720605a2811373de7dfc7cb3765b0e7c9c0fbbd88fa5 image: cr.l5d.io/linkerd/controller:stable-2.14.10 imageID: cr.l5d.io/linkerd/controller@sha256:65bed6a346b259cb1ff04420ee296afa28c38cb3e789ce285e5987f039dddf45 lastState: {} name: sp-validator ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:42Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 initContainerStatuses: - containerID: containerd://895da09209a966c25f996c6d96338d93eb73b46d85b732896fa461903a98175f image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imageID: cr.l5d.io/linkerd/proxy-init@sha256:1075bc22a4a8f0852311dc84c9db0552f1245d07fe4fdebd4bc6cf4566bcbc76 lastState: {} name: linkerd-init ready: true restartCount: 0 started: false state: terminated: containerID: containerd://895da09209a966c25f996c6d96338d93eb73b46d85b732896fa461903a98175f exitCode: 0 finishedAt: "2026-06-03T04:03:58Z" reason: Completed startedAt: "2026-06-03T04:03:58Z" phase: Running podIP: 10.244.0.9 podIPs: - ip: 10.244.0.9 qosClass: Burstable startTime: "2026-06-03T04:03:57Z" - apiVersion: v1 kind: Pod metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: "2026-06-03T04:03:57Z" generateName: linkerd-identity-6b8748ffb7- labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd pod-template-hash: 6b8748ffb7 name: linkerd-identity-6b8748ffb7-9tdjg namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: linkerd-identity-6b8748ffb7 uid: 7074cf19-7e47-44d0-9ceb-1493c7a32427 resourceVersion: "798" uid: 7ad999d8-adfb-44f2-89ec-5c63abdf2c8d spec: containers: - args: - identity - -log-level=info - -log-format=plain - -controller-namespace=linkerd - -identity-trust-domain=cluster.local - -identity-issuance-lifetime=24h0m0s - -identity-clock-skew-allowance=20s - -identity-scheme=linkerd.io/tls - -enable-pprof=false - -kube-apiclient-qps=100 - -kube-apiclient-burst=200 env: - name: LINKERD_DISABLED value: linkerd-await cannot block the identity controller image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9990 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: identity ports: - containerPort: 8080 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9990 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/identity/issuer name: identity-issuer - mountPath: /var/run/linkerd/identity/trust-roots/ name: trust-roots - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-hjpzd readOnly: true - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS value: "8080" - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8080,9990 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: localhost.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-hjpzd readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-hjpzd readOnly: true nodeName: chart-test-swarm-run-18-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-identity serviceAccountName: linkerd-identity terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: identity-issuer secret: defaultMode: 420 secretName: linkerd-identity-issuer - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity - name: kube-api-access-hjpzd projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:05Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:05Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:57Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://f32f60668fb4998356f67d081932dbf6a5017c949cd79fd2c34bfe62406596e4 image: cr.l5d.io/linkerd/controller:stable-2.14.10 imageID: cr.l5d.io/linkerd/controller@sha256:65bed6a346b259cb1ff04420ee296afa28c38cb3e789ce285e5987f039dddf45 lastState: {} name: identity ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:03:59Z" - containerID: containerd://c98cb42b86a376d96fe7fa59d8b77ad59b4028ceee9bddd5dad2af26560768b4 image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imageID: cr.l5d.io/linkerd/proxy@sha256:7876cee0717575ebc39d2b7cfd701e0df28a809bcb2cf4974716a0bce1ce32cb lastState: {} name: linkerd-proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:03Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 initContainerStatuses: - containerID: containerd://6140e3d2c0d7f49a4bcd1392ed1fbb39830c3e7212944655e4dee1cd898f3e69 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imageID: cr.l5d.io/linkerd/proxy-init@sha256:1075bc22a4a8f0852311dc84c9db0552f1245d07fe4fdebd4bc6cf4566bcbc76 lastState: {} name: linkerd-init ready: true restartCount: 0 started: false state: terminated: containerID: containerd://6140e3d2c0d7f49a4bcd1392ed1fbb39830c3e7212944655e4dee1cd898f3e69 exitCode: 0 finishedAt: "2026-06-03T04:03:58Z" reason: Completed startedAt: "2026-06-03T04:03:58Z" phase: Running podIP: 10.244.0.10 podIPs: - ip: 10.244.0.10 qosClass: Burstable startTime: "2026-06-03T04:03:57Z" - apiVersion: v1 kind: Pod metadata: annotations: checksum/config: adca0d68ae2fb26c09960008b88774b0939bca85bc317ce7a1bbdf73fe9e5575 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated config.linkerd.io/opaque-ports: "8443" linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: "2026-06-03T04:03:57Z" generateName: linkerd-proxy-injector-59cd8f84- labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd pod-template-hash: 59cd8f84 name: linkerd-proxy-injector-59cd8f84-rw5vj namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: linkerd-proxy-injector-59cd8f84 uid: 40d38559-d835-40c4-ad5e-5fce5e2b150f resourceVersion: "866" uid: 2b55c99a-6416-4c5e-ad2d-41ac8e436d50 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8443,9995 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-wcfdb readOnly: true - args: - proxy-injector - -log-level=info - -log-format=plain - -linkerd-namespace=linkerd - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9995 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: proxy-injector ports: - containerPort: 8443 name: proxy-injector protocol: TCP - containerPort: 9995 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9995 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/config name: config - mountPath: /var/run/linkerd/identity/trust-roots name: trust-roots - mountPath: /var/run/linkerd/tls name: tls readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-wcfdb readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-wcfdb readOnly: true nodeName: chart-test-swarm-run-18-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-proxy-injector serviceAccountName: linkerd-proxy-injector terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - configMap: defaultMode: 420 name: linkerd-config name: config - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - name: tls secret: defaultMode: 420 secretName: linkerd-proxy-injector-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity - name: kube-api-access-wcfdb projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:59Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:33Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T04:04:33Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T04:03:57Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://c1a3c7a33714290ebe2f8676abe07a664be33e716eabdfc97990381db72db89a image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imageID: cr.l5d.io/linkerd/proxy@sha256:7876cee0717575ebc39d2b7cfd701e0df28a809bcb2cf4974716a0bce1ce32cb lastState: {} name: linkerd-proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:03Z" - containerID: containerd://580598715d3856367de726423b3e11c6c036bc13cd92c1123122a28a0870799c image: cr.l5d.io/linkerd/controller:stable-2.14.10 imageID: cr.l5d.io/linkerd/controller@sha256:65bed6a346b259cb1ff04420ee296afa28c38cb3e789ce285e5987f039dddf45 lastState: {} name: proxy-injector ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T04:04:32Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 initContainerStatuses: - containerID: containerd://0ef91e7b4e52f3935d15758f6658c5fb3fb1c466e3a212634cc42408498f975c image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imageID: cr.l5d.io/linkerd/proxy-init@sha256:1075bc22a4a8f0852311dc84c9db0552f1245d07fe4fdebd4bc6cf4566bcbc76 lastState: {} name: linkerd-init ready: true restartCount: 0 started: false state: terminated: containerID: containerd://0ef91e7b4e52f3935d15758f6658c5fb3fb1c466e3a212634cc42408498f975c exitCode: 0 finishedAt: "2026-06-03T04:03:58Z" reason: Completed startedAt: "2026-06-03T04:03:58Z" phase: Running podIP: 10.244.0.11 podIPs: - ip: 10.244.0.11 qosClass: Burstable startTime: "2026-06-03T04:03:57Z" - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-dst namespace: linkerd resourceVersion: "517" uid: d01ceba1-ff05-4269-b841-20b37075bf88 spec: clusterIP: 10.96.200.196 clusterIPs: - 10.96.200.196 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 8086 protocol: TCP targetPort: 8086 selector: linkerd.io/control-plane-component: destination sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-dst-headless namespace: linkerd resourceVersion: "516" uid: c632c482-a90f-40d0-be42-b9c6c6a5f9c2 spec: clusterIP: None clusterIPs: - None internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 8086 protocol: TCP targetPort: 8086 selector: linkerd.io/control-plane-component: destination sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd name: linkerd-identity namespace: linkerd resourceVersion: "535" uid: 0e421da4-1d16-4a2f-bc2c-eccc6501dd09 spec: clusterIP: 10.96.15.212 clusterIPs: - 10.96.15.212 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 8080 protocol: TCP targetPort: 8080 selector: linkerd.io/control-plane-component: identity sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd name: linkerd-identity-headless namespace: linkerd resourceVersion: "514" uid: 55b0c345-16ae-48b5-8b20-bca25d8ea599 spec: clusterIP: None clusterIPs: - None internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 8080 protocol: TCP targetPort: 8080 selector: linkerd.io/control-plane-component: identity sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-policy namespace: linkerd resourceVersion: "515" uid: 19ea703b-075e-474f-b4de-1cfba165acc3 spec: clusterIP: None clusterIPs: - None internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc port: 8090 protocol: TCP targetPort: 8090 selector: linkerd.io/control-plane-component: destination sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-policy-validator namespace: linkerd resourceVersion: "527" uid: 69c3bf58-f0ae-4e6e-ae4c-0bff58f7dbe9 spec: clusterIP: 10.96.218.103 clusterIPs: - 10.96.218.103 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: policy-https port: 443 protocol: TCP targetPort: policy-https selector: linkerd.io/control-plane-component: destination sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: config.linkerd.io/opaque-ports: "443" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd name: linkerd-proxy-injector namespace: linkerd resourceVersion: "530" uid: 572b788a-72fe-463d-8094-9c4b7e279c91 spec: clusterIP: 10.96.165.170 clusterIPs: - 10.96.165.170 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: proxy-injector port: 443 protocol: TCP targetPort: proxy-injector selector: linkerd.io/control-plane-component: proxy-injector sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" labels: app.kubernetes.io/managed-by: Helm linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-sp-validator namespace: linkerd resourceVersion: "539" uid: 79345923-f50c-4a6b-93bf-ee2aa9d5d980 spec: clusterIP: 10.96.246.155 clusterIPs: - 10.96.246.155 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: sp-validator port: 443 protocol: TCP targetPort: sp-validator selector: linkerd.io/control-plane-component: destination sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: destination app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd name: linkerd-destination namespace: linkerd resourceVersion: "999" uid: a9867ec2-d033-481e-b09d-56d66f21d9cf spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: checksum/config: ae55650be9f3a66e3f923fd0bf8feb16926579a5348ecb5a3e658fc68fbff4e6 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: localhost.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: localhost.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8086,8090,8443,9443,9990,9996,9997 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - destination - -addr=:8086 - -controller-namespace=linkerd - -enable-h2-upgrade=true - -log-level=info - -log-format=plain - -enable-endpoint-slices=true - -cluster-domain=cluster.local - -identity-trust-domain=cluster.local - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9996 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: destination ports: - containerPort: 8086 name: grpc protocol: TCP - containerPort: 9996 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9996 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File - args: - sp-validator - -log-level=info - -log-format=plain - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9997 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: sp-validator ports: - containerPort: 8443 name: sp-validator protocol: TCP - containerPort: 9997 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9997 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: sp-tls readOnly: true - args: - --admin-addr=0.0.0.0:9990 - --control-plane-namespace=linkerd - --grpc-addr=0.0.0.0:8090 - --server-addr=0.0.0.0:9443 - --server-tls-key=/var/run/linkerd/tls/tls.key - --server-tls-certs=/var/run/linkerd/tls/tls.crt - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - --identity-domain=cluster.local - --cluster-domain=cluster.local - --default-policy=all-unauthenticated - --log-level=info - --log-format=plain - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - --probe-networks=0.0.0.0/0 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: admin-http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: policy ports: - containerPort: 8090 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP - containerPort: 9443 name: policy-https protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: admin-http scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: policy-tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-destination serviceAccountName: linkerd-destination terminationGracePeriodSeconds: 30 volumes: - name: sp-tls secret: defaultMode: 420 secretName: linkerd-sp-validator-k8s-tls - name: policy-tls secret: defaultMode: 420 secretName: linkerd-policy-validator-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T04:04:57Z" lastUpdateTime: "2026-06-03T04:04:57Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T04:03:50Z" lastUpdateTime: "2026-06-03T04:04:57Z" message: ReplicaSet "linkerd-destination-5c8c677c54" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 2 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: identity app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd name: linkerd-identity namespace: linkerd resourceVersion: "817" uid: 9a7b8dfa-fe7d-4004-ab2f-03323f16f258 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd spec: containers: - args: - identity - -log-level=info - -log-format=plain - -controller-namespace=linkerd - -identity-trust-domain=cluster.local - -identity-issuance-lifetime=24h0m0s - -identity-clock-skew-allowance=20s - -identity-scheme=linkerd.io/tls - -enable-pprof=false - -kube-apiclient-qps=100 - -kube-apiclient-burst=200 env: - name: LINKERD_DISABLED value: linkerd-await cannot block the identity controller image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9990 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: identity ports: - containerPort: 8080 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9990 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/identity/issuer name: identity-issuer - mountPath: /var/run/linkerd/identity/trust-roots/ name: trust-roots - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS value: "8080" - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8080,9990 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: localhost.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-identity serviceAccountName: linkerd-identity terminationGracePeriodSeconds: 30 volumes: - name: identity-issuer secret: defaultMode: 420 secretName: linkerd-identity-issuer - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T04:04:05Z" lastUpdateTime: "2026-06-03T04:04:05Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T04:03:50Z" lastUpdateTime: "2026-06-03T04:04:05Z" message: ReplicaSet "linkerd-identity-6b8748ffb7" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 2 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: proxy-injector app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd name: linkerd-proxy-injector namespace: linkerd resourceVersion: "880" uid: 657ee6e3-9fb0-4c28-a18f-ee0149c5764e spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: linkerd.io/control-plane-component: proxy-injector strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: checksum/config: adca0d68ae2fb26c09960008b88774b0939bca85bc317ce7a1bbdf73fe9e5575 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated config.linkerd.io/opaque-ports: "8443" linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8443,9995 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - proxy-injector - -log-level=info - -log-format=plain - -linkerd-namespace=linkerd - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9995 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: proxy-injector ports: - containerPort: 8443 name: proxy-injector protocol: TCP - containerPort: 9995 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9995 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/config name: config - mountPath: /var/run/linkerd/identity/trust-roots name: trust-roots - mountPath: /var/run/linkerd/tls name: tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-proxy-injector serviceAccountName: linkerd-proxy-injector terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 420 name: linkerd-config name: config - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - name: tls secret: defaultMode: 420 secretName: linkerd-proxy-injector-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T04:04:33Z" lastUpdateTime: "2026-06-03T04:04:33Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T04:03:50Z" lastUpdateTime: "2026-06-03T04:04:33Z" message: ReplicaSet "linkerd-proxy-injector-59cd8f84" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 2 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:57Z" generation: 1 labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd pod-template-hash: 5c8c677c54 name: linkerd-destination-5c8c677c54 namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-destination uid: a9867ec2-d033-481e-b09d-56d66f21d9cf resourceVersion: "970" uid: 063ed5b1-aab0-4e4c-809e-642a1f08c591 spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination pod-template-hash: 5c8c677c54 template: metadata: annotations: checksum/config: ae55650be9f3a66e3f923fd0bf8feb16926579a5348ecb5a3e658fc68fbff4e6 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd pod-template-hash: 5c8c677c54 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: localhost.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: localhost.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8086,8090,8443,9443,9990,9996,9997 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - destination - -addr=:8086 - -controller-namespace=linkerd - -enable-h2-upgrade=true - -log-level=info - -log-format=plain - -enable-endpoint-slices=true - -cluster-domain=cluster.local - -identity-trust-domain=cluster.local - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9996 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: destination ports: - containerPort: 8086 name: grpc protocol: TCP - containerPort: 9996 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9996 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File - args: - sp-validator - -log-level=info - -log-format=plain - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9997 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: sp-validator ports: - containerPort: 8443 name: sp-validator protocol: TCP - containerPort: 9997 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9997 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: sp-tls readOnly: true - args: - --admin-addr=0.0.0.0:9990 - --control-plane-namespace=linkerd - --grpc-addr=0.0.0.0:8090 - --server-addr=0.0.0.0:9443 - --server-tls-key=/var/run/linkerd/tls/tls.key - --server-tls-certs=/var/run/linkerd/tls/tls.crt - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - --identity-domain=cluster.local - --cluster-domain=cluster.local - --default-policy=all-unauthenticated - --log-level=info - --log-format=plain - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - --probe-networks=0.0.0.0/0 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: admin-http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: policy ports: - containerPort: 8090 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP - containerPort: 9443 name: policy-https protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: admin-http scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: policy-tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-destination serviceAccountName: linkerd-destination terminationGracePeriodSeconds: 30 volumes: - name: sp-tls secret: defaultMode: 420 secretName: linkerd-sp-validator-k8s-tls - name: policy-tls secret: defaultMode: 420 secretName: linkerd-policy-validator-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd pod-template-hash: 6d9b7db89 name: linkerd-destination-6d9b7db89 namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-destination uid: a9867ec2-d033-481e-b09d-56d66f21d9cf resourceVersion: "998" uid: 9d728996-bc58-4375-9c81-a3a80ce6a4d4 spec: replicas: 0 selector: matchLabels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination pod-template-hash: 6d9b7db89 template: metadata: annotations: checksum/config: f240061b1d5ec9b9c0a7b329d138ab1017b1d302bdc8e58c759eb281abea77bf cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: ba2feac2551ee5499b1ef1369f0e7ad0c98a26db069f795a9f9fc2690248b450 creationTimestamp: null labels: linkerd.io/control-plane-component: destination linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-destination linkerd.io/workload-ns: linkerd pod-template-hash: 6d9b7db89 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: localhost.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: localhost.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8086,8090,8443,9443,9990,9996,9997 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - destination - -addr=:8086 - -controller-namespace=linkerd - -enable-h2-upgrade=true - -log-level=info - -log-format=plain - -enable-endpoint-slices=true - -cluster-domain=cluster.local - -identity-trust-domain=cluster.local - -default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9996 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: destination ports: - containerPort: 8086 name: grpc protocol: TCP - containerPort: 9996 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9996 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File - args: - sp-validator - -log-level=info - -log-format=plain - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9997 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: sp-validator ports: - containerPort: 8443 name: sp-validator protocol: TCP - containerPort: 9997 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9997 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: sp-tls readOnly: true - args: - --admin-addr=0.0.0.0:9990 - --control-plane-namespace=linkerd - --grpc-addr=0.0.0.0:8090 - --server-addr=0.0.0.0:9443 - --server-tls-key=/var/run/linkerd/tls/tls.key - --server-tls-certs=/var/run/linkerd/tls/tls.crt - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - --identity-domain=cluster.local - --cluster-domain=cluster.local - --default-policy=all-unauthenticated - --log-level=info - --log-format=plain - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211 - --probe-networks=0.0.0.0/0 image: cr.l5d.io/linkerd/policy-controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: admin-http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: policy ports: - containerPort: 8090 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP - containerPort: 9443 name: policy-https protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: admin-http scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/tls name: policy-tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-destination serviceAccountName: linkerd-destination terminationGracePeriodSeconds: 30 volumes: - name: sp-tls secret: defaultMode: 420 secretName: linkerd-sp-validator-k8s-tls - name: policy-tls secret: defaultMode: 420 secretName: linkerd-policy-validator-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: observedGeneration: 2 replicas: 0 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd pod-template-hash: 69f4bbc8ff name: linkerd-identity-69f4bbc8ff namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-identity uid: 9a7b8dfa-fe7d-4004-ab2f-03323f16f258 resourceVersion: "816" uid: 03a7c4f3-cd30-4580-85c5-0f96e6733cc9 spec: replicas: 0 selector: matchLabels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity pod-template-hash: 69f4bbc8ff template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: ba2feac2551ee5499b1ef1369f0e7ad0c98a26db069f795a9f9fc2690248b450 creationTimestamp: null labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd pod-template-hash: 69f4bbc8ff spec: containers: - args: - identity - -log-level=info - -log-format=plain - -controller-namespace=linkerd - -identity-trust-domain=cluster.local - -identity-issuance-lifetime=24h0m0s - -identity-clock-skew-allowance=20s - -identity-scheme=linkerd.io/tls - -enable-pprof=false - -kube-apiclient-qps=100 - -kube-apiclient-burst=200 env: - name: LINKERD_DISABLED value: linkerd-await cannot block the identity controller image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9990 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: identity ports: - containerPort: 8080 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9990 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/identity/issuer name: identity-issuer - mountPath: /var/run/linkerd/identity/trust-roots/ name: trust-roots - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS value: "8080" - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8080,9990 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: localhost.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-identity serviceAccountName: linkerd-identity terminationGracePeriodSeconds: 30 volumes: - name: identity-issuer secret: defaultMode: 420 secretName: linkerd-identity-issuer - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: observedGeneration: 2 replicas: 0 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:57Z" generation: 1 labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd pod-template-hash: 6b8748ffb7 name: linkerd-identity-6b8748ffb7 namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-identity uid: 9a7b8dfa-fe7d-4004-ab2f-03323f16f258 resourceVersion: "803" uid: 7074cf19-7e47-44d0-9ceb-1493c7a32427 spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity pod-template-hash: 6b8748ffb7 template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: identity linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-identity linkerd.io/workload-ns: linkerd pod-template-hash: 6b8748ffb7 spec: containers: - args: - identity - -log-level=info - -log-format=plain - -controller-namespace=linkerd - -identity-trust-domain=cluster.local - -identity-issuance-lifetime=24h0m0s - -identity-clock-skew-allowance=20s - -identity-scheme=linkerd.io/tls - -enable-pprof=false - -kube-apiclient-qps=100 - -kube-apiclient-burst=200 env: - name: LINKERD_DISABLED value: linkerd-await cannot block the identity controller image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9990 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: identity ports: - containerPort: 8080 name: grpc protocol: TCP - containerPort: 9990 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9990 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/identity/issuer name: identity-issuer - mountPath: /var/run/linkerd/identity/trust-roots/ name: trust-roots - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS value: "8080" - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8080,9990 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: localhost.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-identity serviceAccountName: linkerd-identity terminationGracePeriodSeconds: 30 volumes: - name: identity-issuer secret: defaultMode: 420 secretName: linkerd-identity-issuer - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "2" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:57Z" generation: 1 labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd pod-template-hash: 59cd8f84 name: linkerd-proxy-injector-59cd8f84 namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-proxy-injector uid: 657ee6e3-9fb0-4c28-a18f-ee0149c5764e resourceVersion: "869" uid: 40d38559-d835-40c4-ad5e-5fce5e2b150f spec: replicas: 1 selector: matchLabels: linkerd.io/control-plane-component: proxy-injector pod-template-hash: 59cd8f84 template: metadata: annotations: checksum/config: adca0d68ae2fb26c09960008b88774b0939bca85bc317ce7a1bbdf73fe9e5575 cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated config.linkerd.io/opaque-ports: "8443" linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: e93445f417ed8504c403129e9d222f3c6293f5983145b4f0f05515389956a1fd creationTimestamp: null labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd pod-template-hash: 59cd8f84 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8443,9995 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - proxy-injector - -log-level=info - -log-format=plain - -linkerd-namespace=linkerd - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9995 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: proxy-injector ports: - containerPort: 8443 name: proxy-injector protocol: TCP - containerPort: 9995 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9995 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/config name: config - mountPath: /var/run/linkerd/identity/trust-roots name: trust-roots - mountPath: /var/run/linkerd/tls name: tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-proxy-injector serviceAccountName: linkerd-proxy-injector terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 420 name: linkerd-config name: config - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - name: tls secret: defaultMode: 420 secretName: linkerd-proxy-injector-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 2 labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd pod-template-hash: 8df96d69 name: linkerd-proxy-injector-8df96d69 namespace: linkerd ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: linkerd-proxy-injector uid: 657ee6e3-9fb0-4c28-a18f-ee0149c5764e resourceVersion: "878" uid: d3db44aa-f57a-4ae1-8c8c-f9287cd92621 spec: replicas: 0 selector: matchLabels: linkerd.io/control-plane-component: proxy-injector pod-template-hash: 8df96d69 template: metadata: annotations: checksum/config: 611276908658d1cfcd683b368a2de6ff1348cb62584474e9546c6bd83cfdfd4d cluster-autoscaler.kubernetes.io/safe-to-evict: "true" config.linkerd.io/default-inbound-policy: all-unauthenticated config.linkerd.io/opaque-ports: "8443" linkerd.io/created-by: linkerd/helm stable-2.14.10 linkerd.io/proxy-version: stable-2.14.10 linkerd.io/trust-root-sha256: ba2feac2551ee5499b1ef1369f0e7ad0c98a26db069f795a9f9fc2690248b450 creationTimestamp: null labels: linkerd.io/control-plane-component: proxy-injector linkerd.io/control-plane-ns: linkerd linkerd.io/proxy-deployment: linkerd-proxy-injector linkerd.io/workload-ns: linkerd pod-template-hash: 8df96d69 spec: containers: - env: - name: _pod_name valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: _pod_ns valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: _pod_nodeName valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: LINKERD2_PROXY_LOG value: warn,linkerd=info,trust_dns=error - name: LINKERD2_PROXY_LOG_FORMAT value: plain - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_POLICY_SVC_ADDR value: linkerd-policy.linkerd.svc.cluster.local.:8090 - name: LINKERD2_PROXY_POLICY_WORKLOAD value: $(_pod_ns):$(_pod_name) - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY value: all-unauthenticated - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT value: 100ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT value: 1000ms - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT value: 5s - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT value: 90s - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR value: 0.0.0.0:4190 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR value: 0.0.0.0:4191 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR value: 127.0.0.1:4140 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR value: 0.0.0.0:4143 - name: LINKERD2_PROXY_INBOUND_IPS valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIPs - name: LINKERD2_PROXY_INBOUND_PORTS value: 8443,9995 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES value: svc.cluster.local. - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE value: 10000ms - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION value: 25,587,3306,4444,5432,6379,9300,11211 - name: LINKERD2_PROXY_DESTINATION_CONTEXT value: | {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"} - name: _pod_sa valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: _l5d_ns value: linkerd - name: _l5d_trustdomain value: cluster.local - name: LINKERD2_PROXY_IDENTITY_DIR value: /var/run/linkerd/identity/end-entity - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS valueFrom: configMapKeyRef: key: ca-bundle.crt name: linkerd-identity-trust-roots - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE value: /var/run/secrets/tokens/linkerd-identity-token - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_IDENTITY_SVC_NAME value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_DESTINATION_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local - name: LINKERD2_PROXY_POLICY_SVC_NAME value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local image: cr.l5d.io/linkerd/proxy:stable-2.14.10 imagePullPolicy: IfNotPresent lifecycle: postStart: exec: command: - /usr/lib/linkerd/linkerd-await - --timeout=2m - --port=4191 livenessProbe: failureThreshold: 3 httpGet: path: /live port: 4191 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: linkerd-proxy ports: - containerPort: 4143 name: linkerd-proxy protocol: TCP - containerPort: 4191 name: linkerd-admin protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 4191 scheme: HTTP initialDelaySeconds: 2 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 250m memory: 256Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2102 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/linkerd/identity/end-entity name: linkerd-identity-end-entity - mountPath: /var/run/secrets/tokens name: linkerd-identity-token - args: - proxy-injector - -log-level=info - -log-format=plain - -linkerd-namespace=linkerd - -enable-pprof=false image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /ping port: 9995 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: proxy-injector ports: - containerPort: 8443 name: proxy-injector protocol: TCP - containerPort: 9995 name: admin-http protocol: TCP readinessProbe: failureThreshold: 7 httpGet: path: /ready port: 9995 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/linkerd/config name: config - mountPath: /var/run/linkerd/identity/trust-roots name: trust-roots - mountPath: /var/run/linkerd/tls name: tls readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --incoming-proxy-port - "4143" - --outgoing-proxy-port - "4140" - --proxy-uid - "2102" - --inbound-ports-to-ignore - 4190,4191,4567,4568 - --outbound-ports-to-ignore - 443,6443 image: cr.l5d.io/linkerd/proxy-init:v2.2.3 imagePullPolicy: IfNotPresent name: linkerd-init resources: limits: cpu: 100m memory: 20Mi requests: cpu: 100m memory: 20Mi securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_ADMIN - NET_RAW privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /run name: linkerd-proxy-init-xtables-lock nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-proxy-injector serviceAccountName: linkerd-proxy-injector terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 420 name: linkerd-config name: config - configMap: defaultMode: 420 name: linkerd-identity-trust-roots name: trust-roots - name: tls secret: defaultMode: 420 secretName: linkerd-proxy-injector-k8s-tls - emptyDir: {} name: linkerd-proxy-init-xtables-lock - name: linkerd-identity-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: identity.l5d.io expirationSeconds: 86400 path: linkerd-identity-token - emptyDir: medium: Memory name: linkerd-identity-end-entity status: observedGeneration: 2 replicas: 0 - apiVersion: batch/v1 kind: CronJob metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 meta.helm.sh/release-name: linkerd-control-plane meta.helm.sh/release-namespace: linkerd creationTimestamp: "2026-06-03T04:03:50Z" generation: 1 labels: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: heartbeat app.kubernetes.io/part-of: Linkerd app.kubernetes.io/version: stable-2.14.10 linkerd.io/control-plane-component: heartbeat linkerd.io/control-plane-ns: linkerd name: linkerd-heartbeat namespace: linkerd resourceVersion: "551" uid: 541ef8b8-4a82-4ad9-9ac3-0907e2963bc7 spec: concurrencyPolicy: Replace failedJobsHistoryLimit: 1 jobTemplate: metadata: creationTimestamp: null spec: template: metadata: annotations: linkerd.io/created-by: linkerd/helm stable-2.14.10 creationTimestamp: null labels: linkerd.io/control-plane-component: heartbeat linkerd.io/workload-ns: linkerd spec: containers: - args: - heartbeat - -controller-namespace=linkerd - -log-level=info - -log-format=plain - -prometheus-url=http://prometheus.linkerd-viz.svc.cluster.local:9090 env: - name: LINKERD_DISABLED value: the heartbeat controller does not use the proxy image: cr.l5d.io/linkerd/controller:stable-2.14.10 imagePullPolicy: IfNotPresent name: heartbeat resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 2103 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Never schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: linkerd-heartbeat serviceAccountName: linkerd-heartbeat terminationGracePeriodSeconds: 30 schedule: 13 04 * * * successfulJobsHistoryLimit: 0 suspend: false status: {} kind: List metadata: resourceVersion: ""