Linkerd

A pod can show 2/2 Running and still return HTTP 500 on every request it gets. That's because readiness probes only tell you if the pod answers the kubelet. Meanwhile Kubernetes keeps the broken pod in the endpoint pool and a slice of your users keeps hitting it. Check out Bezaleel Silva's blog post on circuit breaking in Linkerd to learn how to isolate failing endpoints without taking down the Service https://hubs.ly/Q04yWZqr0 #Kubernetes #OpenSource #Linkerd #ServiceMesh

Service Mesh Academy is now Runbook. While we will still cover Linkerd and open source projects that play well with it, we're expanding into platform engineering more broadly. Runbook Live also moves to shorter, 30 to 45 minute sessions, with fireside chats, demos, AMAs, and war stories. For the first session, we'll be joined by Istio maintainer Keith Mattix II, so look forward to a great conversation including polite but real disagreement on a variety of topics. It should be fun! Learn more at https://hubs.ly/Q04yDpKq0 #PlatformEngineering #AI #Kubernetes #Linkerd #Runbook

Is service mesh part of your disaster recovery drills? Riccardo Capraro tested 4 separate failure domains on a multi-cluster Linkerd setup.  Here are two takeaways from Riccardo's third experiment:  ✦ A degraded-but-healthy zone is invisible to topology-based routing, while HAZL adapts and diverts traffic to healthier endpoints. ✦ At rest, HAZL keeps traffic zone-local across cluster boundaries. On open source Linkerd the same workload spreads zone-agnostically, which on a real bill means cross-zone egress on most requests. Read his blog post to learn more → https://hubs.ly/Q04ykDRW0  #Linkerd #Kubernetes #DisasterRecovery #PlatformEngineering

If your Linkerd upgrade involves a runbook and "ask Dave, he's done it before," you've got a single point of failure. The operator pattern fixes this by declaring the mesh version as a Kubernetes object instead of a sequence of commands someone has to remember. Buoyant Enterprise for Linkerd's lifecycle operator bundles it all in one declaration: control plane first, then every meshed workload, with a status field you can query instead of a person you have to find. Check out Buoyant Content Contributor Mesut Oezdil's blog post on everything you need to know about the operator: https://hubs.ly/Q04x9MDJ0 #Kubernetes #PlatformEngineering #Linkerd

"The best service mesh isn't the most powerful one. It's the one your on-call engineer can debug at 3 am without a PhD in Envoy." That's from Moiz E.'s blog post on running Istio across 40+ services, then migrating to Linkerd. Read the full blog post ☞ https://hubs.ly/Q04wrpRX0 #Kubernetes #Linkerd #Istio #ServiceMesh #OpenSource #CloudNative

"Why, sometimes I've believed as many as six impossible things before breakfast" - 𝙻̶𝚎̶𝚠̶𝚒̶𝚜̶ ̶𝙲̶𝚊̶𝚛̶𝚘̶𝚕̶𝚕̶,  Flynn, Technical Evangelist A failed conformance test led us down the rabbit hole of gRPC-ploration! Flynn writes up his journey of navigating the maze known as debugging and returning Linkerd back to conformance wonderland. https://hubs.ly/Q04t34Jz0

The ingress-nginx community project retired in March 2026. That means no more releases, no more patches, and no more security fixes. Yet, many companies are still running it. Why? ingress-nginx keeps serving traffic as if nothing happened. But what if a new critical CVE lands in your ingress layer with no patched version to move to? If your compliance posture requires zero critical CVEs in production, migrating is not optional. The good news: Migrating off an ingress controller doesn't require a cutover weekend. Check out Ivan Porta's latest blog post on the options available and how to smoothly migrate to a new controller alongside the old one. https://hubs.ly/Q04r1ZpD0 #Kubernetes #Security #PlatformEngineering

Multi-region Kubernetes is the standard answer for high availability, but most teams still have a manual step in the middle. If something goes down, someone has to repoint DNS, restore the service, and wait out an outage. Linkerd's federated services address that directly. When a cluster fails, traffic redistributes across the remaining clusters automatically, no runbook, no app changes, no on-call scramble. In this blog post, Linkerd Ambassador Dominik Táskai showcases this with a 3-cluster GKE setup, a chaos test that takes out an entire cluster, and captures how each multicluster mode responds. It also covers when automatic failover is the right default and when your teams should want explicit, cluster-aware routing instead, for example, when data locality requirements mean a service needs to stay in-region. The architecture is fully scripted with a companion repo, so your platform team can run it in a fresh GCP project in about 30 minutes. Learn more at https://hubs.ly/Q04mFPC50  #Linkerd #Kubernetes #SRE #OpenSource #CloudNative #ServiceMesh

Get your free copy of the O'Reilly book on running Linkerd in production: mTLS and certificate rotation, server-based and route-based policy, observability, multicluster, CNI versus init containers, and what actually breaks when you take it to prod. Whether you're evaluating a mesh or already running Linkerd in production, this book has tons of great content for you. Get your edition today ☞ https://hubs.ly/Q04qq6Ps0  #Kubernetes #Linkerd #ServiceMesh #OpenSource #CloudNative

Linkerd rotates expired workloads every 24 hours automatically. You'll never get paged for an expired one. With trust anchors, it's a different story. Nothing rotates them. And when they expire, everything looks fine. Existing mTLS connections keep flowing because the proxies serving them already hold valid certs. The failure shows up the next time a pod restarts. The new proxy can't get a certificate signed against an expired root, so it never passes its startup probe...and that's bad news. In his first Buoyant blog post, Tomas Jamrich describes how to avoid that: https://hubs.ly/Q04qm2LQ0 Shameless plug: You *can* actually automate trust anchor rotation now with Buoyant Enterprise for Linkerd (more to that at the bottom of the blog post). #Kubernetes #OpenSource #Linkerd #CloudNative #ServiceMesh