Linkerd: Upgrade to 2.12 release

[ricsanfre]

Upgrade software request

Upgrade Linkerd to the latest stable version, 2.12, released in Aug. See this linkerd announcement.

New features of release 2.12:

• Per-route polices
• Kubernetes Gateway API support
• Access logging

[ricsanfre]

Helm chart linkerd-viz latest stable version (2.12) fails during installation, when using latest linkerd2 chart, current documented installation. Latest linkerd2 chart is v.2.11.4.

The installation failure is the following

helm install linkerd-viz --create-namespace linkerd/linkerd-viz
Error: INSTALLATION FAILED: unable to build kubernetes objects from release manifest: [unable to recognize "": no matches for kind "AuthorizationPolicy" in version "policy.linkerd.io/v1alpha1", unable to recognize "": no matches for kind "MeshTLSAuthentication" in version "policy.linkerd.io/v1alpha1", unable to recognize "": no matches for kind "NetworkAuthentication" in version "policy.linkerd.io/v1alpha1"]

It fails because it is not able to find linkerd's CRDs that are installed only as part of new linkerd 2.12 chart (linkerd-crds).

Linkerd v2.12 has a a new installation procedure using helm Now the installation requires to deploy two different new charts (old chart linkerd2 is not used anymore):

• linkerd-crd
• linkerd-control-plane

To solve this installation error, linkerd-viz previous release must be installed (specifying --version argument)

helm install linkerd-viz --version 2.11.4 linkerd/linkerd-viz

[ricsanfre]

Traefik proxy injection is not working with new version

linkerd-control-plane helm chart includes configuration for proxyInjector to avoid proxy injection in some namespaces (kube-system and cert-manager):

# proxy injector configuration
proxyInjector:
  # -- Do not create a secret resource for the proxyInjector webhook.
  # If this is set to `true`, the value `proxyInjector.caBundle` must be set
  # or the ca bundle must injected with cert-manager ca injector using
  # `proxyInjector.injectCaFrom` or `proxyInjector.injectCaFromSecret` (see below).
  externalSecret: false

  # -- Namespace selector used by admission webhook.
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      - kube-system
      - cert-manager

With this new configuration traefik proxy injection is not happening.

Instead of removing kube-system namespace from the list of namespaces to be avoided, it is better to deploy traefik in a separate namespace. For doing that traefik k3s addon first need to be disabled. (k3s server argument --no-deploy=traefik)

Currently, Traefik k3s default configuration was already being changed by redeploying the Helm chart with a set of values (enabling prometheus metrics and access logs). Moreover a specific traefik namespace is being used for traefik resources: Middelware, Ingress, etc. So it make sense to deploy Traefik from its helm chart instead of using default k3s add-on, so all traefik resources are in the same namespace.