Linkerd Architecture

Linkerd Architecture An architecture diagram generated by Archify. Proxy Injector · admission webhook · Control Plane Proxy Injector admission webhook Destination · service discovery · Control Plane Destination service discovery Identity · mTLS CA · Control Plane Identity mTLS CA linkerd-proxy · App A sidecar · Data Plane linkerd-proxy App A sidecar linkerd-proxy · App B sidecar · Data Plane linkerd-proxy App B sidecar inject sidecar endpoint updates endpoint updates issue certificate mTLS traffic Control Plane Data Plane Legend Backend Security

Control Plane

  • • Proxy Injector adds the sidecar at pod admission time
  • • Destination pushes service discovery updates to proxies
  • • Identity issues short-lived mTLS certificates

Data Plane

  • • each linkerd-proxy sidecar relays its app's traffic
  • • two proxies establish mTLS between applications