mirror of https://github.com/linkerd/linkerd2.git
110 lines
3.3 KiB
Plaintext
110 lines
3.3 KiB
Plaintext
Linkerd core checks
|
|
===================
|
|
|
|
kubernetes-api
|
|
--------------
|
|
√ can initialize the client
|
|
√ can query the Kubernetes API
|
|
|
|
kubernetes-version
|
|
------------------
|
|
√ is running the minimum Kubernetes API version
|
|
√ is running the minimum kubectl version
|
|
|
|
linkerd-existence
|
|
-----------------
|
|
√ 'linkerd-config' config map exists
|
|
√ heartbeat ServiceAccount exist
|
|
√ control plane replica sets are ready
|
|
√ no unschedulable pods
|
|
√ control plane pods are ready
|
|
√ cluster networks contains all node podCIDRs
|
|
√ cluster networks contains all pods
|
|
|
|
linkerd-config
|
|
--------------
|
|
√ control plane Namespace exists
|
|
√ control plane ClusterRoles exist
|
|
√ control plane ClusterRoleBindings exist
|
|
√ control plane ServiceAccounts exist
|
|
√ control plane CustomResourceDefinitions exist
|
|
√ control plane MutatingWebhookConfigurations exist
|
|
√ control plane ValidatingWebhookConfigurations exist
|
|
√ proxy-init container runs as root user if docker container runtime is used
|
|
|
|
linkerd-identity
|
|
----------------
|
|
√ certificate config is valid
|
|
√ trust anchors are using supported crypto algorithm
|
|
√ trust anchors are within their validity period
|
|
√ trust anchors are valid for at least 60 days
|
|
√ issuer cert is using supported crypto algorithm
|
|
√ issuer cert is within its validity period
|
|
√ issuer cert is valid for at least 60 days
|
|
√ issuer cert is issued by the trust anchor
|
|
|
|
linkerd-webhooks-and-apisvc-tls
|
|
-------------------------------
|
|
√ proxy-injector webhook has valid cert
|
|
√ proxy-injector cert is valid for at least 60 days
|
|
√ sp-validator webhook has valid cert
|
|
√ sp-validator cert is valid for at least 60 days
|
|
√ policy-validator webhook has valid cert
|
|
√ policy-validator cert is valid for at least 60 days
|
|
|
|
linkerd-identity-data-plane
|
|
---------------------------
|
|
√ data plane proxies certificate match CA
|
|
|
|
linkerd-version
|
|
---------------
|
|
√ can determine the latest version
|
|
√ cli is up-to-date
|
|
|
|
linkerd-control-plane-proxy
|
|
---------------------------
|
|
√ control plane proxies are healthy
|
|
√ control plane proxies are up-to-date
|
|
√ control plane proxies and cli versions match
|
|
|
|
linkerd-data-plane
|
|
------------------
|
|
√ data plane namespace exists
|
|
√ data plane proxies are ready
|
|
√ data plane is up-to-date
|
|
√ data plane and cli versions match
|
|
√ data plane pod labels are configured correctly
|
|
√ data plane service labels are configured correctly
|
|
√ data plane service annotations are configured correctly
|
|
√ opaque ports are properly annotated
|
|
|
|
Linkerd extensions checks
|
|
=========================
|
|
|
|
linkerd-viz
|
|
-----------
|
|
√ linkerd-viz Namespace exists
|
|
√ linkerd-viz ClusterRoles exist
|
|
√ linkerd-viz ClusterRoleBindings exist
|
|
√ tap API server has valid cert
|
|
√ tap API server cert is valid for at least 60 days
|
|
√ tap API service is running
|
|
√ linkerd-viz pods are injected
|
|
√ viz extension pods are running
|
|
√ viz extension proxies are healthy
|
|
‼ viz extension proxies are up-to-date
|
|
{{.ProxyVersionErr}}
|
|
see {{.HintURL}}l5d-viz-proxy-cp-version for hints
|
|
√ viz extension proxies and cli versions match
|
|
√ prometheus is installed and configured correctly
|
|
√ can initialize the client
|
|
√ viz extension self-check
|
|
|
|
linkerd-viz-data-plane
|
|
----------------------
|
|
√ data plane namespace exists
|
|
√ prometheus is authorized to scrape data plane pods
|
|
√ data plane proxy metrics are present in Prometheus
|
|
|
|
Status check results are √
|