Running linkerd2-proxy outside of Kubernetes cluster

[hakeemsyd]

What problem are you trying to solve?
I want to run linkerd2-proxy binary on my laptop (or a vm) and be able to have it talk to service mesh just like any other pod. As a test case once proxy is running I want to set it to proxy all requests from my laptop to test.

How I am solving it and what I expect?

1. Install linkerd using helm and provide your custom anchor and issuer certs.
   2 Expose linkerd-identity and linkerd-controller by running kubectl commands e.g.

kubectl expose deployment linkerd-controller  --type=LoadBalancer --name=controller2 -n linkerd
kubectl expose service/linkerd-idenity --type=LoadBalancer -n linkerd --name=external-linkerd-2

3. Make sure new services are available which expose linkerd-identity and linkerd-controller on localhost port 8080 & 8085 respectively.

3. compile linkerd2-proxy on my macbook.
4. Run the linkerd2-proxy binary on my macbook with all env variables set (including DESTINATION_SVC_ADDR & IDENTITY_SVC_ADDR to localhost:8080 & localhsot:8085 respectively per step 3).

export LINKERD2_PROXY_LOG="info,linkerd-info"
# export LINKERD2_PROXY_DESTINATION_GET_NETWORKS="10.0.0.0/8,172.16.0.0/12,1
export LINKERD2_PROXY_CONTROL_LISTEN_ADDR=0.0.0.0:4190
export LINKERD2_PROXY_ADMIN_LISTEN_ADDR=0.0.0.0:4140
export LINKERD2_PROXY_INBOUND_LISTEN_ADDR=0.0.0.0:5143
 export LINKERD2_PROXY_DESTINATION_GET_SUFFIXES=svc.cluster.local.
export LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES=svc.cluster.local.
export LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE=10000ms
export LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE=10000ms
export _pod_ns="(v1:metadata.namespace)"
export LINKERD2_PROXY_DESTINATION_CONTEXT=ns:$_pod_ns
export LINKERD2_PROXY_IDENTITY_DIR=$HOME/keys/linkerd/v2
export exp=2021-10-20T13:29:30Z
export LINKERD2_PROXY_IDENTITY_TOKEN_FILE=$HOME/keys/linkerd/token
export LINKERD2_PROXY_IDENTITY_SVC_ADDR='localhost:8080'
export LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS=`cat ~/keys/linkerd/v2/ca.crt`
# export _pod_sa=(v1:spec.serviceAccountName)
export _l5d_ns=linkerd
export _l5d_trustdomain=cluster.local
export LINKERD2_PROXY_IDENTITY_LOCAL_NAME=linkerd-identity.linkerd.serviceac
export LINKERD2_PROXY_IDENTITY_SVC_NAME=linkerd-identity.linkerd.serviceacco
export LINKERD2_PROXY_DESTINATION_SVC_NAME=linkerd-controller.$_l5d_ns.servi
export LINKERD2_PROXY_TAP_SVC_NAME=linkerd-tap.$_l5d_ns.serviceaccount.ident

4. Set linkerd proxy address localhost:5143 as my system proxy in network settings on mac
5. Be able to browse a website on browser after that and see proxy forwarding the requests

What is actually happening?
Linkerd2-proxy binary running on my mac unable to talk to identity to get itself certified from identity service which I already exposed from kubernetes cluster.
linkerd proxy throws error 403 when i hit it with any request. I am attaching logs file from linkerd proxy logs with tracing logs level.

logs.txt

[olix0r]

Hi @hakeemsyd,

This may not be what you want to hear, but the proxy simply is not intended to do anything useful when run outside of Kubernetes. For one, the outbound proxy uses the SO_ORIGINAL_DST socket option to drive discovery and routing; and to the best of my knowledge this is just not possible on macOS.

Let's back up to the first question, though: What problem are you trying to solve by running the proxy locally? Have you considered other solutions to this? If so, why aren't they suitable? Why do you feel that running the proxy on your laptop the best solution to this problem?

[hakeemsyd]

Thank you @olix0r for you response.
I actually took a step back and found Kuma to be better solution to my problem here.
https://kuma.io/docs/0.7.3/

I am changing my approach and using kuma instead.