linkerd2 Is the latest version supported access logs ?

[eddielishan]

Excuse me, it seems that version 2.11 installed through getting started does not support access_Log, I see
https://github.com/linkerd/linkerd2-proxy/releases/tag/release%2Fv2.171.0 With this function, I want to ask, linkerd2-proxy v2.171.0 can be installed and used separately in the production environment.. Or does the main version 2.12 support access_Log? when will it be released? Thank you.

[mateiidavid]

Hey @eddielishan, we've introduced support for access log style metrics in this edge version: https://github.com/linkerd/linkerd2/blob/main/CHANGES.md#edge-2215 (22.1.5). You can use any edge version from 22.1.5 onwards, or wait for stable-2.12.0.

You can use an edge proxy for your control plane component that runs stable-2.11.x, but we do not recommend it. Edge versions are released weekly and will generally focus on adding new features. Keep in mind, there is also no way to configure the access log endpoint through the CLI or annotations, unless you use a recent edge version.

Hope this clears it up!

[eddielishan]

Hey @mateiidavid
thank you very much, I tested the latest version and don't know if there is a bug？ accesslog client.id how similar to the called service name account-service,this client.id come from? Why not write to the client service name .

{"client.addr":"10.1.1.222:54554","client.id":"default.default.serviceaccount.identity.linkerd.cluster.local","host":"account-service:8080","method":"GET","processing_ns":"241200","request_bytes":"","response_bytes":"53","status":200,"timestamp":"2022-02-10T03:54:36.684844000Z","total_ns":"3651100","trace_id":"","uri":"http://account-service:8080/name","user_agent":"Java/1.8.0_111","version":"HTTP/2.0"}

[mateiidavid]

@eddielishan,

Linkerd has a security first focus through mTLS. Our identity (required for mTLS) is at a pod level. Each pod has its own identity and certificate. We do this by using ServiceAccount resources, this way, each pod in a deployment can mount the SA and share the identity.

The useful thing with ServiceAccounts, other than their scope, is that they also have a token. We use this token for CSRs when requesting certificates for a proxy. If we would use a logical service, we'd have no way of knowing that a pod really does belong to the service. You can read more about our mTLS implementation here. When traffic is proxied, we have a l5d-client-id header that includes the identity of the pod to identify the source of the traffic.

Again, the identity through an SA is a guarantee that you're actually talking to a pod that has that identity (since a certificate was acquired using the SA); a logical Kubernetes service makes no such guarantees. In your case, you see default because you're using the default SA for your namespace. Here's an example of an SA resource and a deployment that mounts it:

kind: ServiceAccount
apiVersion: v1
metadata:
  name: web
  namespace: emojivoto
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: emojivoto
  labels:
    app.kubernetes.io/name: web
    app.kubernetes.io/part-of: emojivoto
    app.kubernetes.io/version: v11
spec:
replicas: 1
  selector:
    matchLabels:
      app: web-svc
      version: v11
  template:
    metadata:
      labels:
        app: web-svc
        version: v11
    spec:
      serviceAccountName: web
     ...

[src]

TL;DR: create an SA for your deployment, mount it in the deployment, and client_id will correctly mirror the client's identity.

[eddielishan]

Thank you very much for your patient answer. thanks

[mateiidavid]

Happy to help :) Hope it all worked well in the end?

[eddielishan]

I'd like to ask linkerd Multi-cluster communication gateway services of type Must it LoadBalancer, not NodePort or ingress?

[eddielishan]

Hey @mateiidavid
I'd like to ask linkerd Multi-cluster communication gateway services of type Must it LoadBalancer, not NodePort or ingress?

[mateiidavid]

Hey @eddielishan, it can be either LoadBalancer or NodePort. An ingress typically uses a load balancer underneath afaik, it's more of a "route" than a service. For NodePort you can check out #6175 and associated PRs to see how you can make it work.

[eddielishan]

@mateiidavid
ok,thank .In addition, I'd like to ask linkerd Multi-cluster Is automatic failover supported? For example, a service fails. Automatically transfer traffic to another cluster，If yes, how to configure or operate it. thank you!