mirror of https://github.com/linkerd/linkerd2.git
d08dcb0a37
linkerd/linkerd2#2349 introduced a `SelfSubjectAccessReview` check at startup, to determine whether each control-plane component should establish Kubernetes watches cluster-wide or namespace-wide. If this check occurs before the linkerd-proxy sidecar is ready, it fails, and the control-plane component restarts. This change configures each control-plane pod to skip outbound port 443 when injecting the proxy, allowing the control-plane to connect to Kubernetes regardless of the `linkerd-proxy` state. A longer-term fix should involve a more robust control-plane startup, that is resilient to failed Kubernetes API requests. An even longer-term fix could involve injecting `linkerd-proxy` as a Kubernetes "sidecar" container, when that becomes available. Workaround for #2407 Signed-off-by: Andrew Seigner <siggy@buoyant.io> |
||
|---|---|---|
| .. | ||
| testdata | ||
| check.go | ||
| check_test.go | ||
| completion.go | ||
| completion_test.go | ||
| dashboard.go | ||
| doc.go | ||
| endpoints.go | ||
| endpoints_test.go | ||
| get.go | ||
| get_test.go | ||
| inject.go | ||
| inject_test.go | ||
| inject_util.go | ||
| install-cni-plugin.go | ||
| install-cni-plugin_test.go | ||
| install-sp.go | ||
| install-sp_test.go | ||
| install.go | ||
| install_test.go | ||
| logs.go | ||
| logs_test.go | ||
| main_test.go | ||
| profile.go | ||
| profile_test.go | ||
| root.go | ||
| routes.go | ||
| routes_test.go | ||
| stat.go | ||
| stat_test.go | ||
| tap.go | ||
| tap_test.go | ||
| top.go | ||
| uninject.go | ||
| uninject_test.go | ||
| version.go | ||
| version_test.go | ||