Is it possible create a serviceprofile based on authority?

[luizhpriotto]

An authority like any DNS like the FQDN "internal.linkerd.io" for example.

I wouldn't like to use this annotation in my Nginx ingress:

nginx.ingress.kubernetes.io/service-upstream: "true"

Thanks,

[adleong]

Hi @luizhpriotto. Can you give some more context on what problem you're trying to solve here and how your services are structured? Typically, intra-cluster (east-west) traffic is addressed to kubernetes services which have FQDN like name.namespace.svc.domain. On the other hand, ingress traffic is usually TLS and therefore handled as an opaque stream by Linkerd, which means that service profiles are not applied.

[luizhpriotto]

Thanks @adleong.

My services: ingress nginx --> api1 --> api2

I don't want to use retry policies, fault injection etc... with Linkerd in this moment. I just want to collect metrics and detect errors between nginx and api1. Between api1 and api2 already worked.

I'm actually using nginx to do my "retry policies" via the 'nginx.ingress.kubernetes.io/proxy-next-upstream' annotation because I have a lot of endpoints and it works fine, because is a global rule. But if I set the annotation nginx.ingress.kubernetes.io/service-upstream: "true", the authority changes to DNS of the k8s service, so I can collect the metrics I need with Linkerd but my retry policies through nginx ( service-upstrem) stops working, because nginx doesn't know about pods anymore.

I'm trying to create my service profile based on external DNS/Host, the same one I captured as authority on tap, for example. "internal.test.com", but the Linkerd don't detect the routes I registered in the service profile.

kind: ServiceProfile
metadata:
  creationTimestamp: null
  name: internal.test.com
  namespace: test
spec:
  routes:
  - condition:
[...]

Sorry if I didn't make myself clear.

Thanks again.

[luizhpriotto]

I got! I returned here to inform that I solved my problem and how. It was very simple. I followed this documentation:

layer5

But, it wasn't sufficient, I have to change other config that is a little hidden in the documentation of Linkerd (end of page).

proxy-configuration

(linkerd.io/inject: ingress annotation rather than the default linkerd.io/inject: enabled)

Now I dont need to set this annotation bellow to match my serviceprofile to my service.

nginx.ingress.kubernetes.io/service-upstream: "true"