GKE Autopilot + Linkerd appears to be possible as of 6/22/2023

[revero-doug]

https://cloud.google.com/kubernetes-engine/docs/release-notes-new-features#June_22_2023

GKE Autopilot now supports the ability to deploy your own service mesh. Many service meshes, such as Istio or LinkerD, require CAP_NET_ADMIN Linux capability to function, which is disabled on Autopilot clusters by default to reduce the size of the security attack surface. You can now optionally enable NET_ADMIN on your Autopilot clusters if you need this capability for your service meshes or other opt-in use cases. See Autopilot Security for more information for how to enable NET_ADMIN.

#8422 is locked, but the info within appears to be outdated

[wmorgan]

Great find @revero-doug! And possible the first mention of Linkerd on cloud.google.com docs. 🤣 I've left a comment on that issue.

[revero-doug]

@wmorgan so far so good, but I think there's a false positive warning when running linkerd check after a seemingly successful linkerd install --ha | kubectl apply -f -:

linkerd-ha-checks
-----------------
‼ pod injection disabled on kube-system
    kube-system namespace needs to have the label config.linkerd.io/admission-webhooks: disabled if injector webhook failure policy is Fail
    see https://linkerd.io/2.13/checks/#l5d-injection-disabled for hints

note that kube-system is managed by GKE Autopilot, so adding labels to the namespace is not allowed, but per the below MutatingWebhookConfiguration, it doesn't seem like it should be necessary.

mutatingwebhookconfiguration/linkerd-proxy-injector-webhook-config looks like this, note that namespaceSelector seems to already exclude kube-system:

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"admissionregistration.k8s.io/v1","kind":"MutatingWebhookConfiguration","metadata":{"annotations":{},"labels":{"linkerd.io/control-plane-component":"proxy-injector","linkerd.io/control-plane-ns":"linkerd"},"name":"linkerd-proxy-injector-webhook-config"},"webhooks":[{"admissionReviewVersions":["v1","v1beta1"],"clientConfig":{"caBundle":"[redacted]","service":{"name":"linkerd-proxy-injector","namespace":"linkerd","path":"/"}},"failurePolicy":"Fail","name":"linkerd-proxy-injector.linkerd.io","namespaceSelector":{"matchExpressions":[{"key":"config.linkerd.io/admission-webhooks","operator":"NotIn","values":["disabled"]},{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kube-system","cert-manager"]}]},"objectSelector":null,"rules":[{"apiGroups":[""],"apiVersions":["v1"],"operations":["CREATE"],"resources":["pods","services"]}],"sideEffects":"None"}]}
  creationTimestamp: "2023-07-10T17:59:08Z"
  generation: 2
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
  name: linkerd-proxy-injector-webhook-config
  resourceVersion: "19576541"
  uid: e6047942-28b1-4661-9307-a04264f7e90e
webhooks:
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    caBundle: "[redacted]"
    service:
      name: linkerd-proxy-injector
      namespace: linkerd
      path: /
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: linkerd-proxy-injector.linkerd.io
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      - kube-system
      - cert-manager
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      - kube-system
      - gke-gmp-system
      - gke-managed-cim
  objectSelector: {}
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    - services
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10

[alpeb]

Thanks for the report. Indeed, that check needs to be a bit smarter and also check that namespace selector. Would be a nice first contribution 😉 😉