Linkerd insights

Clock Skew Breaking TLS Certificate Validationcritical

Time differences exceeding 5 minutes between control plane and cluster nodes cause TLS validation failures, as nodes may incorrectly determine certificates are expired or not yet valid.

Tap Service Unresponsive Blocking Traffic Inspectionwarning

The Linkerd tap service may fail to respond to live traffic inspection requests, eliminating critical debugging visibility. Often caused by tap pod crashes, network policy blocks, or resource constraints.

Linkerd proxies return HTTP 502 when backend connections are refused or closed without explanation. These errors often become visible only after mesh injection, exposing previously undetected connection issues.

Linkerd proxies automatically retry failed requests, but misconfigured retry policies create cascading delays invisible to application monitoring. Retries add cumulative latency that doesn't appear in application logs since requests ultimately succeed.

Linkerd proxy connection pools can become saturated during traffic spikes, causing increased latency and waiters. Pool size limits and too-many-waiters conditions indicate backend service capacity issues.

For non-HTTP protocols, Linkerd only reports TCP-level metrics (bytes, connections) without application-layer success/failure information. This makes debugging opaque protocols difficult as you only see connection state, not request outcomes.

Proxy Resource Exhaustion Under High Loadcritical

Linkerd proxy sidecars have default CPU and memory limits that may be insufficient for high-throughput services. Proxy resource exhaustion manifests as increased latency, throttling, or connection failures without obvious application issues.

Without service profiles, Linkerd cannot provide per-route metrics, making it impossible to identify which specific endpoints are failing or slow. All traffic gets aggregated into a [DEFAULT] catch-all route.

Metrics Server Failure in Meshed Namespaceswarning

Kubernetes metrics-server stops collecting pod metrics after Linkerd injection due to cAdvisor bug with CRI runtime. Terminated linkerd-init containers continue producing metrics, causing metrics-server to ignore entire pods.