instruction: How do you deploy and configure Linkerd service mesh?
output: Installing Linkerd with Helm | Linkerd Docs Community Get Involved Adopters & Case Studies Linkerd Ambassadors Become an Ambassador Buoyant's Linkerd Forum Blog FAQ Enterprise Star Join Forum Announcing Linkerd 2.18: Battlescars, lessons learned, and preliminary Windows support Learn more You are viewing docs for an older version of Linkerd. You may want the latest documentation for this page instead. Linkerd edge Linkerd 2.18 Linkerd 2.17 Linkerd 2.16 Linkerd 2.15 Linkerd 2.14 Linkerd 2.13 Linkerd 2.12 Linkerd 2.11 Linkerd 2.10 Overview Getting Started Features HTTP, HTTP/2, and gRPC Proxying TCP Proxying and Protocol Detection Retries and Timeouts Automatic mTLS Ingress Telemetry and Monitoring Load Balancing Authorization Policy Automatic Proxy Injection CNI Plugin Dashboard and on-cluster metrics stack Distributed Tracing Fault Injection High Availability HTTP Access Logging Multi-cluster communication Proxy Init Iptables Modes Service Profiles Topology Aware Routing Traffic Split (canaries, blue/green deploys) Tasks Adding your services to Linkerd Automated Canary Releases Automatic Multicluster Failover Automatically Rotating Control Plane TLS Credentials Automatically Rotating Webhook TLS Credentials Bringing your own Prometheus Configuring Per-Route Policy Configuring Proxy Concurrency Configuring Retries Configuring Timeouts Control Plane Debug Endpoints Customizing Linkerd's Configuration with Kustomize Debugging 502s Debugging gRPC applications with request tracing Debugging HTTP applications with per-route metrics Distributed tracing with Linkerd Enabling Topology Aware Routing Exporting Metrics Exposing the Dashboard Generating your own mTLS root certificates Getting Per-Route Metrics Getting started with Linkerd SMI extension Graceful Pod Shutdown Grafana Ingress traffic Injecting Faults Installing Linkerd Installing Linkerd with Helm Installing Multi-cluster Components Linkerd and Pod Security Policies (PSP) Manually Rotating Control Plane TLS Credentials Modifying the Proxy Log Level Multi-cluster communication Multi-cluster communication with StatefulSets Replacing expired certificates Restricting Access To Services Rotating webhooks certificates Securing Linkerd Tap Setting Up Service Profiles Troubleshooting Uninstalling Linkerd Uninstalling Multicluster Upgrading Linkerd Using a Custom Cluster Domain Using A Private Docker Repository Using extensions Using GitOps with Linkerd with Argo CD Using the Debug Sidecar Validating your mTLS traffic Reference Architecture Authorization Policy CLI authz check completion diagnostics identity inject install install-cni jaeger multicluster profile uninject uninstall upgrade version viz Cluster Configuration Extensions List Helm Chart Version Matrix IPTables Reference Proxy Configuration Proxy Log Level Proxy Metrics Service Profiles What is a service mesh? Frequently Asked Questions Releases and Versions Design Principles Going to Production Service Mesh Glossary Installing Linkerd with Helm Linkerd can be installed via Helm rather than with the linkerd install command. This is recommended for production, since it allows for repeatability. Linkerd Production Tip This page contains best-effort instructions by the open source community. Production users with mission-critical applications should familiarize themselves with Linkerd production resources and/or connect with a commercial Linkerd provider . Prerequisite: generate identity certificates To do automatic mutual TLS , Linkerd requires trust anchor certificate and an issuer certificate and key pair. When you&rsquo;re using linkerd install , we can generate these for you. However, for Helm, you will need to generate these yourself. Please follow the instructions in Generating your own mTLS root certificates to generate these. Helm install procedure for stable releases # To add the repo for Linkerd stable releases: helm repo add linkerd https://helm.linkerd.io/stable # To add the repo for Linkerd edge releases: helm repo add linkerd-edge https://helm.linkerd.io/edge The following instructions use the linkerd repo. For installing an edge release, just replace with linkerd-edge , and add the --devel flag to all commands. Helm install procedure You need to install two separate charts in succession: first linkerd-crds and then linkerd-control-plane . Note If installing Linkerd in a cluster that uses Cilium in kube-proxy replacement mode, additional steps may be needed to ensure service discovery works as intended. Instrunctions are on the Cilium cluster configuration page. linkerd-crds The linkerd-crds chart sets up the CRDs linkerd requires: helm install linkerd-crds linkerd/linkerd-crds \ -n linkerd --create-namespace Note This will create the linkerd namespace. If it already exists or you&rsquo;re creating it beforehand elsewhere in your pipeline, just omit the --create-namespace flag. Note If you are using Linkerd&rsquo;s CNI plugin , you must also add the --set cniEnabled=true flag to your helm install command. linkerd-control-plane The linkerd-control-plane chart sets up all the control plane components: helm install linkerd-control-plane \ -n linkerd \ --set-file identityTrustAnchorsPEM = ca.crt \ --set-file identity.issuer.tls.crtPEM = issuer.crt \ --set-file identity.issuer.tls.keyPEM = issuer.key \ linkerd/linkerd-control-plane Note If you are using Linkerd&rsquo;s CNI plugin , you must also add the --set cniEnabled=true flag to your helm install command. Enabling high availability mode The linkerd-control-plane chart contains a file values-ha.yaml that overrides some default values to set things up under a high-availability scenario, analogous to the --ha option in linkerd install . Values such as higher number of replicas, higher memory/cpu limits, and affinities are specified in those files. You can get values-ha.yaml by fetching the chart file: helm fetch --untar linkerd/linkerd-control-plane Then use the -f flag to provide this override file. For example: helm install linkerd-control-plane \ -n linkerd \ --set-file identityTrustAnchorsPEM = ca.crt \ --set-file identity.issuer.tls.crtPEM = issuer.crt \ --set-file identity.issuer.tls.keyPEM = issuer.key \ -f linkerd-control-plane/values-ha.yaml \ linkerd/linkerd-control-plane Upgrading with Helm First, make sure your local Helm repos are updated: helm repo update helm search repo linkerd NAME CHART VERSION APP VERSION DESCRIPTION linkerd/linkerd-crds &lt;chart-semver-version&gt; Linkerd gives you observability, reliability, and securit... linkerd/linkerd-control-plane &lt;chart-semver-version&gt; stable-2.14.10 Linkerd gives you observability, reliability, and securit... During an upgrade, you must choose whether you want to reuse the values in the chart or move to the values specified in the newer chart. Our advice is to use a values.yaml file that stores all custom overrides that you have for your chart. The helm upgrade command has a number of flags that allow you to customize its behavior. Special attention should be paid to --reuse-values and --reset-values and how they behave when charts change from version to version and/or overrides are applied through --set and --set-file . For example: --reuse-values with no overrides - all values are reused --reuse-values with overrides - all except the values that are overridden are reused --reset-values with no overrides - no values are reused and all changes from provided release are applied during the upgrade --reset-values with overrides - no values are reused and changed from provided release are applied together with the overrides no flag and no overrides - --reuse-values will be used by default no flag and overrides - --reset-values will be used by default Finally, before upgrading, check whether there are breaking changes to the chart (i.e. renamed or moved keys, etc). You can consult the stable or the edge chart docs, depending on which one your are upgrading to. If there are, make the corresponding changes to your values.yaml file. Then you can use: # the linkerd-crds chart currently doesn&#39;t have a values.yaml file helm upgrade linkerd-crds linkerd/linkerd-crds # whereas linkerd-control-plane does helm upgrade linkerd-control-plane linkerd/linkerd-control-plane --reset-values -f values.yaml --atomic The --atomic flag will ensure that all changes are rolled back in case the upgrade operation fails. Linkerd was originally created by Buoyant View Code of Conduct Community GitHub Slack Linkerd Forum Follow Linkedin YouTube Twitter Edit This Site Copyright © 2025 Linkerd Authors. All rights reserved.