Proxy Configuration

Linkerd provides a set of annotations that can be used to override the dataplane proxy's configuration. This is useful for overriding the defaultconfigurations of auto-injected proxies.

The following is the list of supported annotations:

AnnotationDescription
config.alpha.linkerd.io/proxy-wait-before-exit-secondsThe proxy sidecar will stay alive for at least the given period before receiving SIGTERM signal from Kubernetes but no longer than pod's terminationGracePeriodSeconds. If not provided, it will be defaulted to 0
config.alpha.linkerd.io/trace-collector-service-accountThe trace collector's service account name. E.g., tracing-service-account. If not provided, it will be defaulted to default.
config.linkerd.io/admin-portProxy port to serve metrics on
config.linkerd.io/control-portProxy port to use for control
config.linkerd.io/debug-imageLinkerd debug container image name
config.linkerd.io/debug-image-pull-policyDocker image pull policy for debug image
config.linkerd.io/debug-image-versionLinkerd debug container image version
config.linkerd.io/disable-identityDisables resources from participating in TLS identity
config.linkerd.io/disable-tapDisables resources from being tapped
config.linkerd.io/enable-debug-sidecarInject a debug sidecar for data plane debugging
config.linkerd.io/enable-external-profilesEnable service profiles for non-Kubernetes services
config.linkerd.io/image-pull-policyDocker image pull policy
config.linkerd.io/inbound-portProxy port to use for inbound traffic
config.linkerd.io/init-imageLinkerd init container image name
config.linkerd.io/init-image-versionLinkerd init container image version
config.linkerd.io/outbound-portProxy port to use for outbound traffic
config.linkerd.io/proxy-cpu-limitMaximum amount of CPU units that the proxy sidecar can use
config.linkerd.io/proxy-cpu-requestAmount of CPU units that the proxy sidecar requests
config.linkerd.io/proxy-imageLinkerd proxy container image name
config.linkerd.io/proxy-log-levelLog level for the proxy
config.linkerd.io/proxy-memory-limitMaximum amount of Memory that the proxy sidecar can use
config.linkerd.io/proxy-memory-requestAmount of Memory that the proxy sidecar requests
config.linkerd.io/proxy-uidRun the proxy under this user ID
config.linkerd.io/proxy-versionTag to be used for the Linkerd proxy images
config.linkerd.io/skip-inbound-portsPorts that should skip the proxy and send directly to the application
config.linkerd.io/skip-outbound-portsOutbound ports that should skip the proxy
config.linkerd.io/trace-collectorService name of the trace collector. E.g. oc-collector.tracing:55678

For example, to update an auto-injected proxy's CPU and memory resources, weinsert the appropriate annotations into the spec.template.metadata.annotationsof the owner's pod spec, using kubectl edit like this:

  1. spec:
  2. template:
  3. metadata:
  4. annotations:
  5. config.linkerd.io/proxy-cpu-limit: "1.5"
  6. config.linkerd.io/proxy-cpu-request: "0.2"
  7. config.linkerd.io/proxy-memory-limit: 2Gi
  8. config.linkerd.io/proxy-memory-request: 128Mi

Note that configuration overrides on proxies injected using the linkerd injectcommand is planned for release 2.4. Follow thisGitHub issue for progress.