Linkerd Lightweight Service Mesh

Istio is powerful but complex. Linkerd does 80% of what Istio does with 20% of the operational burden. If you need mTLS, golden metrics, and traffic reliability without a week of configuration, Linkerd is the answer.

Installation

# Install CLI
curl -fsL https://run.linkerd.io/install | sh

# Validate cluster
linkerd check --pre

# Install control plane
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Verify
linkerd check

Three commands. No Helm values file. No custom resource configuration.

Mesh a Namespace

# Add Linkerd proxy to all pods in a namespace
kubectl annotate namespace production linkerd.io/inject=enabled

# Restart deployments to inject proxies
kubectl rollout restart deployment -n production

Every pod gets a Linkerd sidecar proxy. All traffic between meshed services is automatically encrypted with mTLS.

What You Get Immediately

Automatic mTLS

Zero configuration. Every connection between meshed services is encrypted with mutually authenticated TLS. Certificates are rotated automatically.

# Verify mTLS is active
linkerd viz edges deployment -n production

Golden Metrics

Request rate, success rate, and latency for every service — without application instrumentation:

# Live metrics
linkerd viz stat deployment -n production

NAME          MESHED   SUCCESS   RPS    P50    P99
order-api     3/3      99.8%     42.3   5ms    28ms
payment-svc   2/2      98.2%     18.7   12ms   89ms
inventory     2/2      100%      31.1   3ms    15ms

# Real-time traffic view
linkerd viz top deployment/order-api -n production

Retries and Timeouts

apiVersion: policy.linkerd.io/v1beta3
kind: HTTPRoute
metadata:
  name: order-api-route
  namespace: production
spec:
  parentRefs:
    - name: order-api
      kind: Service
      group: core
      port: 8080
  rules:
    - timeouts:
        request: 3s
      retry:
        limit: 2
        conditions:
          - statusCodes: [502, 503]

Dashboard

# Install the viz extension
linkerd viz install | kubectl apply -f -

# Open dashboard
linkerd viz dashboard

The dashboard shows service topology, live traffic, success rates, and latency distributions. No Prometheus or Grafana setup required (though Linkerd integrates with both).

Traffic Splitting

Canary deployments with weighted traffic:

apiVersion: split.smi-spec.io/v1alpha2
kind: TrafficSplit
metadata:
  name: order-api-canary
  namespace: production
spec:
  service: order-api
  backends:
    - service: order-api-stable
      weight: 900
    - service: order-api-canary
      weight: 100

90% to stable, 10% to canary. Adjust weights as confidence grows.

Resource Overhead

Compare to Istio's Envoy sidecar at 50-100MB per pod. Linkerd's Rust-based proxy (linkerd2-proxy) is significantly lighter.

Linkerd vs Istio

Choose Linkerd when simplicity and resource efficiency matter. Choose Istio when you need advanced traffic management, fault injection, or complex authorization policies.

For most teams starting with a service mesh, Linkerd is the pragmatic choice. You can always migrate to Istio later if you outgrow it.

---

Ready to go deeper? Master Kubernetes networking with hands-on courses at CopyPasteLearn.