Experimental: CNI Plugin

Linkerd installs can be configured to run aCNI plugin that rewrites eachpod’s iptables rules automatically. Rewriting iptables is required for routingnetwork traffic through the pod’s linkerd-proxy container. When the CNI pluginis enabled, individual pods no longer need to include an init container thatrequires the NET_ADMIN capability to perform rewriting. This can be useful inclusters where that capability is restricted by cluster administrators.

This feature is currently experimental, as it has not been tested on mostmajor cloud providers. Followthis issue for statusupdates.

Installation

Usage of the Linkerd CNI plugin requires that the linkerd-cni DaemonSet besuccessfully installed on your cluster first, before installing the Linkerdcontrol plane.

To install the linkerd-cni DaemonSet, run:

  1. linkerd install-cni | kubectl apply -f -

Once the DaemonSet is up and running, all subsequent installs that include alinkerd-proxy container (including the Linkerd control plane), no longer needto include the linkerd-init container. Omission of the init container iscontrolled by the —linkerd-cni-enabled flag at control plane install time.

Install the Linkerd control plane, with:

  1. linkerd install --linkerd-cni-enabled | kubectl apply -f -

This will set a cniEnabled flag in the global linkerd-config ConfigMap. Allsubsequent proxy injections will read this field and omit init containers.

Additional configuration

The linkerd install-cni command includes additional flags that you can use tocustomize the installation. See linkerd install-cni —help for moreinformation. Note that many of the flags are similar to the flags that can beused to configure the proxy when running linkerd inject. If you change adefault when running linkerd install-cni, you will want to ensure that youmake a corresponding change when running linkerd inject.

The most important flags are:

  • —dest-cni-net-dir: This is the directory on the node where the CNIConfiguration resides. It defaults to: /etc/cni/net.d.
  • —dest-cni-bin-dir: This is the directory on the node where the CNI Pluginbinaries reside. It defaults to: /opt/cni/bin.
  • —cni-log-level: Setting this to debug will allow more verbose logging.In order to view the CNI Plugin logs, you must be able to see the kubeletlogs. One way to do this is to log onto the node and usejournalctl -t kubelet. The string linkerd-cni: can be used as a search tofind the plugin log output.