Service profile generation should not require cluster access

[purkhusid]

Hey! My team is evaluating Linkerd2 and I was trying out the service profile feature I found it very strange that it requires access to the k8s cluster to generate a profile from proto.

From looking at the code there does not seem like there is any good reason for requiring that the user has access to the k8s cluster to generate the profile.

Requiring k8s access makes it harder to generate the service profile during development or update it automatically in CI.
Would you be willing to accept a change to the CLI that removes the check from the profile command when generating profiles from proto/swagger? If so, would you like the check removed or would you like a flag that disables the check?

[alpeb]

Hi @purkhusid , that's a good point. In the particular cases of --open-api and --proto access is required solely to extract the linkerd-config ConfigMap to retrieve the global.clusterDomain entry that will be used to build the profile's name (e.g. foobar.default.svc.cluster.local).
I think it'd be cool to add support for a flag like --cluster-domain for that purpose, in which case no cluster connection would be attempted 👍
(--tap would naturally still require cluster access so that new flag would be ignored in this case)

[olix0r]

At the least, it seems like we should support --ignore-cluster flag to be consistent with install/upgrade.

[adleong]

Sounds like a reasonable feature. @purkhusid, would you like to file an issue or PR for this?

[purkhusid]

I've created an issue: #5401
I might send an PR once we are further along with our Linkerd adoption.

[adleong]

Thanks!