Is Linkerd Ingress controller "Proxy ingress" mode mTLS'd?

[shahriak]

I was not able to find anything in the documentation. But is the Proxy Ingress Mode mtLS'd? The reason I am asking is because Ingress mode tremendously improves the performance and latency in our high scale service. However, there's no proxy sidecar injected when the ingress controller is in Ingress mode.

[shahriak]

Can someone please help answer this? Ideally we would like mTLS with good latency.

[cpretzer]

@shahriak when the ingress pod is injected with the Linkerd proxy and communicates with another pod injected with the proxy (i.e. both pods are meshed), the proxies will use mTLS issued by the identity service to communicate with each other in both Proxy Ingress and Default modes

The docs describe how Proxy Ingress mode is different. In short, Proxy Ingress mode enables the proxy to make load balancing decisions (instead of the ingress controller pod) and also enables the use of Service Profiles, TrafficSplits, etc.

In both modes, mTLS is enabled when there are proxies on both ends of the connection

[shahriak]

@cpretzer Thanks for your reply. If mTLs is enabled, the ingress controller in Proxy Ingress mode should show "meshed" in Linkerd dashboard as well as in the Linkerd edges command. But do not see it. In short, how do we verify it's mTLS enabled?

[shahriak]

Is this a bug in 2.10.2 version?

[cpretzer]

hi @shahriak it doesn't look like your ingress controller is injected with the linkerd proxy. It shows 0/100 pods meshed.

Can you share the YAML for the ingress controller and make sure that you've added the linkerd.io/inject: ingress annotation?

[shahriak]

@cpretzer Here's the yaml:

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
    meta.helm.sh/release-name: linkerd
    meta.helm.sh/release-namespace: linkerd
  creationTimestamp: "2021-06-26T23:02:27Z"
  generation: 1
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: linkerd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 0.47.0
    helm.sh/chart: ingress-nginx-3.33.0
  name: linkerd-ingress-nginx-controller
  namespace: linkerd
  resourceVersion: "20897825"
  selfLink: /apis/apps/v1/namespaces/linkerd/deployments/linkerd-ingress-nginx-controller
  uid: 448cc547-bed4-4abf-a738-55c7e0aa84cf
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: linkerd
      app.kubernetes.io/name: ingress-nginx
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        linkerd.io/inject: Ingress
      creationTimestamp: null
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: linkerd
        app.kubernetes.io/name: ingress-nginx
    spec:
      containers:
      - args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/linkerd-ingress-nginx-controller
        - --election-id=ingress-controller-leader
        - --ingress-class=nginx
        - --configmap=$(POD_NAMESPACE)/linkerd-ingress-nginx-controller
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: LD_PRELOAD
          value: /usr/local/lib/libmimalloc.so
        image: myacr.azurecr.io/ingress-nginx/controller:v0.47.0
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - /wait-shutdown
        livenessProbe:
          failureThreshold: 5
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: controller
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          name: https
          protocol: TCP
        - containerPort: 8443
          name: webhook
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: "4"
            memory: 2Gi
          requests:
            cpu: "2"
            memory: 1Gi
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsUser: 101
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /usr/local/certificates/
          name: webhook-cert
          readOnly: true
        - mountPath: /etc/nginx/certs
          name: nginx-mtls-certs
          readOnly: true
      dnsPolicy: ClusterFirst
      nodeSelector:
        glscommerce.microsoft.com/role: linkerd
        kubernetes.io/os: linux
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: linkerd-ingress-nginx
      serviceAccountName: linkerd-ingress-nginx
      terminationGracePeriodSeconds: 300
      volumes:
      - configMap:
          defaultMode: 420
          name: mtls-certs
        name: nginx-mtls-certs
      - name: webhook-cert
        secret:
          defaultMode: 420
          secretName: linkerd-ingress-nginx-admission
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2021-06-26T23:02:42Z"
    lastUpdateTime: "2021-06-26T23:02:42Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2021-06-26T23:02:27Z"
    lastUpdateTime: "2021-06-26T23:02:42Z"
    message: ReplicaSet "linkerd-ingress-nginx-controller-7474874777" has successfully
      progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

[shahriak]

@cpretzer Ok I made a very silly mistake. It's suppose to be ingress not Ingress :(

Thanks a lot for your help!

[cpretzer]

I'm so glad you found that! I make typos like that pretty frequently, and that's a way to learn 😊

Let us know if you have any more questions