LoginSign Up
← Back to all sparks
Linkerd logo

Linkerd

DEVOPS
Velocity2.5

Service mesh

linkerd.io ↗

Linkerd publishes an outside threat model of the mesh, with steps for operators.

service-meshkubernetessecuritythreat-modelreliability
◆Current state
Linkerd's feed has been quiet since the 2.20 release in June, which added rate-limit-aware load balancing and cut memory use. The 10 November post reports what an independent threat model found in Linkerd and what operators should do next; the feed carries only the title, so the specific findings are not visible here. Most other recent posts are operational explainers rather than releases.
◆Where it's heading
The project keeps leaning on security and operational trust: post-quantum mTLS by default in 2.19, tuning in 2.20, and now an external review of its attack surface. The emphasis is on making an existing mesh safer to run rather than adding new surface.
◆Prediction
Expect hardening changes or new default settings tied to the threat model findings in the next stable or edge release; the entry does not say which components are affected.

◆Recent moves

  1. 4d ago

    What an Independent Threat Model Found in Linkerd, and What You Should Do Next

    An independent threat model of Linkerd, published with guidance on what operators should change. It continues the security-first line set by 2.19's post-quantum mTLS, though the feed shows only the title, not the findings.

    View source ↗
  2. 4mo ago

    Federating Clusters for Zero-Downtime Kubernetes

    A long-form post on federating clusters for zero-downtime Kubernetes operations. Educational content rather than a release, though the topic hints at where multi-cluster work may be heading.

    View source ↗
  3. 4mo ago

    Announcing Linkerd 2.20: Rate-limit-aware load balancing, reduced memory usage, better inbound metrics, and more

    Linkerd 2.20 adds rate-limit-aware load balancing, cuts memory usage, and improves inbound metrics. Solid data-plane tuning that fits the project's pattern of making existing behaviour cheaper and more predictable rather than adding new abstractions.

    View source ↗
  4. 6mo ago

    The Proxy Died First: How Kubernetes Native Sidecars Solve the Service Mesh Shutdown Problem

    An explainer on how Kubernetes native sidecars fix the long-standing problem of the proxy terminating before the application. Useful operational context, but it documents a platform behaviour rather than a Linkerd change.

    View source ↗
  5. 8mo ago

    Deep Dive: How linkerd-destination works in the Linkerd Service Mesh

    A community deep dive into the linkerd-destination control plane component, republished from an ambassador's blog. Internals documentation, not a shipped change.

    View source ↗
  6. 9mo ago

    Linkerd Protocol Detection

    A guest post explaining how the proxy detects protocols by inspecting the first bytes of a connection. Existing behaviour explained rather than new capability.

    View source ↗