Linkerd Proxy and InternalTrafficPolicy

[aa250816]

For pods with the linkerd sidecar injected linkerd replaces the kube-proxy with it’s own linkerd-proxy that functions similar to the kube-proxy and uses the services and associated endpoints to route traffic. It seems like it does not support or respect the internalTrafficPolicy of a service. In testing this on a cluster traffic from a pod one node could get routed to an endpoint for a pod on an a different node even with internalTrafficPolicy: local on the service used. For example:

So my question is there any way to replicate internalTrafficPolicy: local when linkerd is enabled? I’ve come across topology aware service routing which I initially stayed away from since it has a lot more complexity which would give us a lot more room to make mistakes in the configuration especially when internalTrafficPolicy gets us what we need. Linkerd seemed to support it. The topology aware keys has been deprecated and replaced by topology aware hints which again linkerd does seem to support but does not have much if any docs on. Reading into topology aware hints further doesn’t seem like it will get us exactly what we want since it has some constraints about when it applies the hints and doesn’t have any guarantees about routing like internal traffic policy.

If there is not any way to replicate internalTrafficPolicy: local today are there any plans for the linkerd-proxy to take that into account like it does for the topology aware hints?

[risingspiral]

I believe this was introduced as a stable feature in K8s with 1.26. We're currently targeting 1.26 support with the upcoming release of Linkerd 2.13 targeting early this year. We'll have more specifics on a release date and internalTrafficPolicy: local support soon.

cc @adleong

[yc185050]

Created a PR to address this issue. #10186