Linkerd Breaks Kubernetes Internal DNS

[fbongiovanni29]

When I inject linkerd into my namespace:

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    linkerd.io/inject: enabled
    meta.helm.sh/release-name: my-release
    meta.helm.sh/release-namespace: my-namespace
  labels:
    app.kubernetes.io/managed-by: Helm
    name: my-release
  name: my-release

It breaks the connection to my mysql database which uses google cloudsqlproxy hitting sqlproxy-eventing.my-namespace.svc.cluster.local:5432

I have a helm hook that waits for a database connection to be ready. Normally, it will curl the db and get an exit code of 26 while it's spinning up and an exit code of 52 when it's ready.

When I install linkerd it gives an exit code of 0 no matter what. I validated that it also breaks the connection to my rails application.

When I look at the logs for the linkerd-proxy container, I get this error repeating every second:

[   191.047040s]  WARN ThreadId(01) outbound: linkerd2_reconnect::service: Service failed error=channel closed

Not sure if this is a bug or a feature of Linkerd

Update:

Not sure if this was a step in the right direction but for testing I set network policies to allow all ingress & egress and now I'm getting this in the linkerd-proxy container logs:

[    19.619331s]  WARN ThreadId(02) daemon:admin{listen.addr=0.0.0.0:4191}:accept{peer.addr=10.204.3.35:51598 target.addr=10.204.3.40:4191}: rustls::session: Sending fatal alert AccessDenied
[    19.619528s]  INFO ThreadId(02) daemon:admin{listen.addr=0.0.0.0:4191}:accept{peer.addr=10.204.3.35:51598 target.addr=10.204.3.40:4191}: linkerd2_app_core::serve: Connection closed error=unexpected error: no server certificate chain resolved

> linkerd check --proxy
...
√ data plane namespace exists
| waiting for check to complete E0122 11:27:42.418528   38240 portforward.go:385] error copying from local connection to remote stream: read tcp6 [::1]:50269->[::1]:50271: read: connection reset by peer
E0122 11:27:47.518875   38240 portforward.go:385] error copying from local connection to remote stream: read tcp6 [::1]:50269->[::1]:50273: read: connection reset by peer

[olix0r]

It breaks the connection to my mysql database which uses google cloudsqlproxy hitting sqlproxy-eventing.my-namespace.svc.cluster.local:5432

You should probably add 5432 to the config.linkerd.io/outbound-skip-ports configuration on your workload/namespace. See https://linkerd.io/2/features/protocol-detection/ for more information.

[fbongiovanni29]

Yup, that fixed it! Thanks so much