Skip to Main Content
Linkerd: Up and Running
book

Linkerd: Up and Running

by Jason Morgan, Flynn
April 2024
Intermediate to advanced content levelIntermediate to advanced
262 pages
6h 12m
English
O'Reilly Media, Inc.
Content preview from Linkerd: Up and Running

Chapter 8. Linkerd Policy: Overview and Server-Based Policy

Microservices applications, as we discussed in Chapter 7, require a different level of network security than more traditional monoliths. mTLS gives you the secure communications and workload identity that you need to start tackling this level of network security—but it’s Linkerd’s policy mechanisms that provide the ability to use that identity to control how workloads can talk to each other in your environment.

Linkerd supports two kinds of policy mechanisms: Server-based and route-based. Since policy is the single most complex area of Linkerd, we’ll provide an overview and cover Server-based policy in this chapter, then tackle route-based policy in Chapter 9.

Linkerd Policy Overview

All Linkerd policy mechanisms are based on explicit authorization: Linkerd starts out assuming that it should allow nothing and must be explicitly told what requests should be allowed. This lines up nicely with the zero trust model and makes it straightforward to reason about permissions, since policy resources are always permitting things to happen.

Don’t panic, though; this doesn’t mean a policy is always a morass of hundreds of resources. Linkerd allows setting a default policy at the cluster, namespace, and Pod levels, with policy settings at more specific levels overriding policy settings at more general levels: Pods override namespaces, which override cluster-wide settings, as shown in Figure 8-1.

Figure 8-1. Different Linkerd default ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Istio: Up and Running

Istio: Up and Running

Lee Calcote, Zack Butcher
gRPC: Up and Running

gRPC: Up and Running

Kasun Indrasiri, Danesh Kuruppu
Istio in Action

Istio in Action

Rinor Maloku, Christian E. Posta
Rust in Action

Rust in Action

Tim McNamara

Publisher Resources

ISBN: 9781098142308Errata Page