How to set authorization policy when same port is used for kubelet healthchecks and application service

[darshini-ramesh]

I am trying to apply Server and ServerAuthorization crd for namespace with linkerd inbound default policy set to deny, but application container port and kubelet probes (liveness and readiness) on the same port "port:8080"
port name is port and number is 8080.

If client is set to unauthenticated : true (this is done as default policy is to deny) in ServerAuthorization, all the connections are allowed. Now, how to control the communication between specific microservices?

Server and Authorization policy code below:

apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  namespace: namespaceA
  name: serviceB 
spec:
  podSelector:
    matchLabels: 
      app: serviceB 
  port: port

apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  namespace: namespaceA
  name: admin-port
spec:
  server:
    name: serviceB
  client:
    unauthenticated : true

apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  namespace: namespaceA
  name: serviceB 
spec:
  server:
    name: serviceB 
  client:
    meshTLS:
      serviceAccounts:
      - namespace: namespaceA
        name: serviceC

below is what I am trying to achieve

In the namespaceA, I want to enable kubelet probes and allow connection between serviceB and serviceC and restrict communication between serviceB and serviceA.
But since "port:8080" is already allowing all communication because of unauthenticated:true, even serviceA can communicate to serviceB.
Configuring clusterNetworks in the Linkerd configuration tighter might not solve this case.

What are possible solutions to fix this scenario? I want to later try similar between namespaces.

Thank you

[darshini-ramesh]

Following was suggest in slack: (https://linkerd.slack.com/archives/C89RTCWJF/p1645156022524329)