LinkedIn
Observability and Reliability for Kubernetes
Increase reliability and observability without touching a single line of code in your Kubernetes applications. Linkerd delivers instant insight with golden metrics and Open Telemetry tracing, while enhancing reliablity with automated certificate rotation.
Why uniform metrics are hard in a polyglot cluster
Every service emits metrics differently, or not at all, and instrumenting each one by hand across languages and frameworks is extremely challenging. With a service mesh, the operational work is the kind of toil that causes a cluster wide outage when a step is missed.
Linkerd solves this polyglot problem by moving the responsibility of observability out of the application layer and into the platform layer. Instead of changing your code, Linkerd injects a tiny, ultra-fast sidecar proxy (written in Rust) next to every single container in your cluster.
A project that never finishes
Success Rates: Every service emits status codes differently. No consistent signal across the fleet.
Latency Distributions: p99 slowdowns stay invisible until a end user reports. Teams can measures latency differently.
Request volume (RPS): Throughput lives in dashboards. Scaling runs on intuition.
Done the day you mesh it
Success Rates: Calculated by monitoring HTTP status codes or gRPC response status codes.
Latency Distributions: Tracks how long requests take, breaking them down into percentiles to surface edge-case slowdowns.
Request Volume (RPS): Measures the throughput or number of requests per second hitting a service.
Learn how Linkerd golden metrics are defined for your entire application. Read the blog ↗
What you get
From the moment the proxy is injected, you get consistent golden metrics across every meshed service — no instrumentation, no code changes. The operational work, like certificate rotation, that quietly causes outages gets automated too.
Golden metrics, no instrumentation
Success rate, RPS, and latency percentiles for every meshed service, the moment the proxy is injected.
Cert rotation as a non-event
Linkerd auto-rotates proxy certs every 24 hours. With Buoyant Enterprise for Linkerd (BEL), users can automate even trust anchor rotation.
How does Linkerd observability work?
Linkerd's proxy reads every meshed connection and records golden metrics (success rate, requests per second, latency percentiles) for HTTP, HTTP/2, and gRPC, with no code change. Those metrics are scraped into Prometheus and surfaced on the dashboard, ready for SLOs and alerts. The control plane issues and rotates identities, and the BEL trust-anchor rotation operator handles the one cert step most likely to cause an outage.
What it covers, and what it doesn't
Linkerd always provides the golden metrics, and as of 2.20, Linkerd exports distributed tracing spans to OpenTelemetry. You'll still need to pair the mesh with your tracing and APM stack.
Without Buoyant Enterprise for Linkerd
✗ Full APM or application profiling
✗ Long-term metrics storage
✗ Grafana (not bundled since 2.12)
✗ Trust-anchor rotation automation on OSS / pre-2.20
✓ Success rate, RPS, and latency percentiles, every service
✓ Proxy cert auto-rotation (24 h)
✓ Support for cert-manager issuer rotation
✓ Community support
With Buoyant Enterprise for Linkerd
✓ Success rate, RPS, and latency percentiles, every service
✓ Per-service and per-route visibility
✓ Distributed tracing → OpenTelemetry (2.20)
✓ Proxy cert auto-rotation every 24 h
✓ Lifecycle automation
✓ Trust anchor rotation automation (2.20)
✓ Continuous security vulnerability scanning
✓ Dedicated enterprise support
Why Linkerd for observability and reliability
1
Zero-Code Observability
Automatically capture and visualize crucial L7 golden metrics (latency, success rates, and volume) across all services. As of 2.20, inbound metrics reach parity with outbound, with new HTTP and gRPC duration and frame-size histograms, and distributed tracing spans export to OpenTelemetry following its semantic conventions.
2
Automated Zero-Downtime Certificate Rotation
Introduced in the 2.20 release, it eliminates a major source of operational risk and potential mesh-wide downtime by completely automating mTLS trust anchor renewals and data plane orchestration behind the scenes.
3
A lighter control plane at scale
Linkerd 2.20 refactored the destination controller, which has historically driven most of Linkerd's memory use, cutting control-plane memory by up to 85% in some cases on large, high-churn clusters.
4
Automated GitOps-Ready Upgrades
The built-in operator entirely automates the toil of control plane updates and data plane proxy rollouts across all clusters, delivering seamless, zero-downtime upgrades that are fully compatible with GitOps tools like Argo and Flux.
5
Intelligent, Multi-Zone Reliability
Ensures high availability and shields your system from single-zone failures using automated retries, circuit breaking, and advanced High Availability Zonal Load Balancing (HAZL).
6
Enterprise-Scale Resilience
By layering automated multi-cluster failover and continuous operational diagnostics onto Linkerd’s ultra-fast, memory-safe Rust proxy, BEL guarantees your architecture remains resilient, secure, and cost-effective under heavy production load.
1. Cost
Cuts cost and protects reliability
HAZL is a "request-level load balancer in Buoyant Enterprise for Linkerd that balances HTTP and gRPC traffic in environments with multiple availability zones," and unlike Topology Aware Routing "never sacrifices reliability to achieve this cost reduction."
2. Reliability
It reacts to real load
HAZL balances on outstanding requests per endpoint and prefers local endpoints, adding cross-zone only when local load climbs. It uses in-band health checking, and reads rate-limit responses: an in-zone endpoint returning HTTP 429 is a reason to spill rather than a fast success (a BEL feature) In the same failure that dropped Topology Aware Routing to 0%, HAZL held near 100%.
3. Simplicity
It works where TAR struggles
Fewer than 3 pods per zone, imbalanced traffic, autoscaling, and "requires no tuning or configuration" in most cases. It also preserves zone affinity across cluster boundaries.
Show me the evidence
Every claim is backed by a reproducible demo, a published cost model, and a CNCF track record.
Outages caught before impact
loveholidays caught hundreds of failed deployments before they became outages, using SLIs and SLOs built on Linkerd's metrics.
Trusted in production
Trusted in production by Tradeshift, Expel and teams at Walmart, HP, and Expedia.
Frequently asked questions
Do I need to instrument my code to get metrics?
No. Linkerd records golden metrics at the proxy for all meshed traffic, with no code change.
Does Linkerd replace my APM or tracing?
No. These are L7 traffic metrics; pair them with your tracing and APM tools.