⚖️ Istio vs Linkerd — The Full Comparison

Side-by-side: same task, both tools

🎯 The Decision Guide

Cilium Mesh — the third option

If you're already running Cilium as your CNI, its sidecar-free mesh mode uses eBPF at the kernel level for mTLS and L7 policy — no sidecar injection, zero memory overhead per pod. If you're not on Cilium, the migration cost is high. But for greenfield clusters it's worth serious consideration.

🔐 mTLS — Zero Configuration

Linkerd's most compelling feature for security teams: mTLS is automatic and on by default. The identity control plane component issues workload certificates signed by the trust anchor (a root CA). Certificates rotate every 24 hours without any restart.

# Verify mTLS between two services — no CRDs required
linkerd viz edges deployment -n production

# Output shows secured/unsecured status per edge:
# SRC              DST            SECURED
# checkout-api  →  payment-svc    √  (mTLS)
# checkout-api  →  postgres       ✗  (not meshed)

# Check identity of a specific deployment
linkerd identity -n production deploy/checkout-api

# Tap live traffic (like tcpdump, but L7-aware)
linkerd viz tap deploy/checkout-api -n production \
  --to deploy/payment-svc \
  --method POST

# Output (live stream of requests):
# req id=0:1 proxy=out src=10.0.1.5:52341 dst=10.0.2.8:8080 :method=POST :path=/api/charge
# rsp id=0:1 proxy=out src=10.0.1.5:52341 dst=10.0.2.8:8080 :status=200 latency=45ms

Authorization Policy (Linkerd 2.11+)

Linkerd added L4/L7 authorization via its own simpler CRD set — Server, ServerAuthorization, and HTTPRoute:

# Define which port of a service is being protected
apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  name: payment-svc-http
  namespace: production
spec:
  podSelector:
    matchLabels: { app: payment-svc }
  port: 8080
  proxyProtocol: HTTP/2

---
# Only allow checkout-svc (by ServiceAccount) to reach the Server
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: allow-checkout
  namespace: production
spec:
  server:
    name: payment-svc-http
  client:
    meshTLS:
      serviceAccounts:
      - name: checkout-svc
        namespace: production

🚦 Traffic Management — HTTPRoute

Linkerd implements the Kubernetes Gateway API HTTPRoute for traffic splitting and routing — instead of inventing its own VirtualService equivalent:

# Traffic split: 80% v1, 20% v2 canary using Gateway API HTTPRoute
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: checkout-api-canary
  namespace: production
spec:
  parentRefs:
  - name: checkout-api
    kind: Service
    group: core
  rules:
  - backendRefs:
    - name:   checkout-api-v1
      port:   8080
      weight: 80
    - name:   checkout-api-v2
      port:   8080
      weight: 20

📊 Observability — The Viz Extension

# Real-time golden metrics for all services in a namespace
linkerd viz stat deploy -n production

# Output:
# NAME           MESHED  SUCCESS  RPS    LATENCY_P50  P99    SECURED
# checkout-api   3/3     99.80%   42.5   4ms          32ms   100%
# payment-svc    2/2     99.95%   18.2   7ms          45ms   100%
# notification   1/1     98.10%   5.0    120ms        890ms  100%   ← slow!

# Live traffic tap — inspect individual requests
linkerd viz tap ns/production

# Service topology graph
linkerd viz dashboard &   # opens browser with service graph

# Jaeger tracing integration
linkerd jaeger install | kubectl apply -f -
# Traces automatically sampled and sent to Jaeger

🧠 Knowledge Check