Skip to content


Choose a tag to compare
@github-actions github-actions released this 06 Nov 18:51
· 2916 commits to main since this release

Warning: there is a known issue where upgrading to this release with the --prune flag as described in the Linkerd Upgrade documentation will delete certain Linkerd configuration and prevent you from performing any subsequent upgrades. It is highly recommended that you skip this version and instead upgrade directly to stable-2.9.3 or later. If you have already upgraded to this version, you can repair your installation by upgrading your CLI to stable-2.9.3 and using the linkerd repair command.


This release extends Linkerd's zero-config mutual TLS (mTLS) support to all TCP
connections, allowing Linkerd to transparently encrypt and authenticate all TCP
connections in the cluster the moment it's installed. It also adds ARM support,
introduces a new multi-core proxy runtime for higher throughput, adds support
for Kubernetes service topologies, and lots, lots more, as described below:

(For upgrade instructions please check the docs)

  • Proxy

    • Performed internal improvements for lower latencies under high concurrency
    • Reduced performance impact of logging, especially when the debug or
      trace log levels are disabled
    • Improved error handling for DNS errors encountered when discovering control
      plane addresses; this can be common during installation before all
      components have been started, allowing linkerd to continue to operate
      normally in HA during node outages
  • Control Plane

    • Added support for topology-aware service

      to the Destination controller; when providing service discovery updates to
      proxies the Destination controller will now filter endpoints based on the
      service's topology preferences
    • Added support for the new Kubernetes
      resource to the Destination controller; Linkerd can be installed with
      --enable-endpoint-slices flag to use this resource rather than the
      Endpoints API in clusters where this new API is supported
  • Dashboard

    • Added new Spanish translations (please help us translate into your
    • Added new section for exposing multicluster gateway metrics
  • CLI

    • Renamed the --addon-config flag to --config to clarify this flag can be
      used to set any Helm value
    • Added fish shell completions to the linkerd command
  • Multicluster

    • Replaced the single service-mirror controller with separate controllers
      that will be installed per target cluster through linkerd multicluster link
    • Changed the mechanism for mirroring services: instead of relying on
      annotations on the target services, now the source cluster should specify
      which services from the target cluster should be exported by using a label
    • Added support for creating multiple service accounts when installing
      multicluster with Helm to allow more granular revocation
    • Added a multicluster unlink command for removing multicluster links
  • Prometheus

    • Moved Linkerd's bundled Prometheus into an add-on (enabled by default); this
      makes the Linkerd Prometheus more configurable, gives it a separate upgrade
      lifecycle from the rest of the control plane, and allows users to
      disable the bundled Prometheus instance
    • The long-awaited Bring-Your-Own-Prometheus case has been finally addressed:
      added global.prometheusUrl to the Helm config to have linkerd use an
      external Prometheus instance instead of the one provided by default
    • Added an option to persist data to a volume instead of memory, so that
      historical metrics are available when Prometheus is restarted
    • The helm chart can now configure persistent storage and limits
  • Other

    • Added a new ingress annotation and accompanying
      --ingress flag to the inject command, to configure the proxy to support
      service profiles and enable per-route metrics and traffic splits for HTTP
      ingress controllers
    • Changed the type of the injector and tap API secrets to
      so they can be provisioned by cert-manager
    • Changed default docker image repository to from; Users
      who pull the images into private repositories should take note of this
    • Introduced support for authenticated docker registries
    • Simplified the way that Linkerd stores its configuration; configuration is
      now stored as Helm values in the linkerd-config ConfigMap
    • Added support for Helm configuration of per-component proxy resources

This release includes changes from a massive list of contributors. A special
thank-you to everyone who helped make this release possible:
Abereham G Wodajie, Alexander Berger, Ali Ariff, Arthur Silva Sens, Chris Campbell,
Daniel Lang, David Tyler, Desmond Ho, Dominik Münch, George Garces, Herrmann Hinz,
Hu Shuai, Jeffrey N. Davis, Joakim Roubert, Josh Soref, Lutz Behnke, MaT1g3R,
Marcus Vaal, Markus, Matei David, Matt Miller, Mayank Shah, Naseem, Nil, OlivierB,
Olukayode Bankole, Paul Balogh, Rajat Jindal, Raphael Taylor-Davies, Simon Weald,
Steve Gray, Suraj Deshmukh, Tharun Rajendran, Wei Lun, Zhou Hao, ZouYu, aimbot31,
iohenkies, memory and tbsoares