feat!: Add config to disable proxy /shutdown admin endpoint

charts/linkerd-control-plane/README.md

@@ -241,6 +241,7 @@ Kubernetes: `>=1.22.0-0`
 | proxy.disableInboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the inbound side of the proxy by setting it to a very high value |
 | proxy.disableOutboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the outbound side of the proxy by setting it to a very high value |
 | proxy.enableExternalProfiles | bool | `false` | Enable service profiles for non-Kubernetes services |
+| proxy.enableShutdownEndpoint | bool | `false` | Enables the proxy's /shutdown admin endpoint |
 | proxy.gid | int | `-1` | Optional customisation of the group id under which the proxy runs (the group ID will be omitted if lower than 0) |
 | proxy.image.name | string | `"cr.l5d.io/linkerd/proxy"` | Docker image for the proxy |
 | proxy.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy container image |

charts/linkerd-control-plane/values.yaml

@@ -149,6 +149,8 @@ proxy:
     # -- Tag for the proxy container image
     # @default -- linkerdVersion
     version: ""
+  # -- Enables the proxy's /shutdown admin endpoint
+  enableShutdownEndpoint: false
   # -- Log level for the proxy
   logLevel: warn,linkerd=info,trust_dns=error
   # -- Log format (`plain` or `json`) for the proxy

charts/linkerd2-cni/README.md

@@ -25,7 +25,7 @@ Kubernetes: `>=1.22.0-0`
 | commonLabels | object | `{}` | Labels to apply to all resources |
 | destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
 | destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
-| disableIPv6 | bool | `false` | Disables adding IPv6 rules on top of IPv4 rules |
+| disableIPv6 | bool | `true` | Disables adding IPv6 rules on top of IPv4 rules |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the linkerd-cni ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
 | extraInitContainers | list | `[]` | Add additional initContainers to the daemonset |
 | ignoreInboundPorts | string | `""` | Default set of inbound ports to skip via iptables |

charts/partials/templates/_proxy.tpl

@@ -28,6 +28,8 @@ env:
 - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
   value: {{.Values.proxy.requireTLSOnInboundPorts | quote}}
 {{ end -}}
+- name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+  value: {{.Values.proxy.enableShutdownEndpoint | quote}}
 - name: LINKERD2_PROXY_LOG
   value: {{.Values.proxy.logLevel | quote}}
 - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,trust_dns=error
         - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,trust_dns=error
         - name: LINKERD2_PROXY_LOG_FORMAT
@@ -267,6 +269,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,trust_dns=error
         - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,trust_dns=error
         - name: LINKERD2_PROXY_LOG_FORMAT