April 2024
Intermediate to advanced
262 pages
6h 12m
English
Content preview from Linkerd: Up and Running
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 9. Linkerd Route-Based Policy
In Chapter 8, we discussed implementing a Linkerd Server-based policy to enhance the security of the emojivoto application. This policy ensures that Linkerd effectively safeguards the application’s workload, preventing unauthorized workloads from making requests. Suppose we want to go further, though? For example, consider a situation where you have a sensitive application. You need to be certain that only specific ServiceAccounts are allowed to make changes, and only certain others have access to read.
That’s where Linkerd’s route-based policy mechanism comes in. In this chapter, we’ll take a closer look at what route-based policy can do and how to use it.
Route-Based Policy Overview
Route-based policy gives Linkerd a way to express policy that depends not only on which workloads are in play, but also on which specific requests are being made. These specific HTTP requests are identified by using Gateway API HTTPRoute resources to specify matches against the HTTP path, method, headers, etc.—almost anything except the body can be used. Requests are still authenticated using mTLS identities.
Gateway API HTTPRoute resources work by associating one or more parents with one or more rules. When using Gateway API for ingress, the parents of an HTTPRoute will be Gateway resources; however, this doesn’t make much sense when using Gateway API to configure a service mesh. When using HTTPRoutes with Linkerd, the parents will be Services instead, and ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.