-
What is the issue?I want to run a mesh with no mTLS. I've followed the documentation and trying to disable identity as outlined below. I use helm based deployment...and my linkerd version is stable-2.11.1
proxy configurationproxy:
Error: UPGRADE FAILED: template: linkerd2/templates/proxy-injector.yaml:8:3: executing "linkerd2/templates/proxy-injector.yaml" at <include "linkerd.proxy.validation" .Values.proxy>: error calling include: template: linkerd2/charts/partials/templates/_validate.tpl:3:4: executing "linkerd.proxy.validation" at <fail (printf "Can't disable identity mTLS for %s. Set '.Values.proxy.disableIdentity' to 'false'" .component)>: error calling fail: Can't disable identity mTLS for %!s(). Set '.Values.proxy.disableIdentity' to 'false' My deployment is within a secure corporate network and instead of having to rotate certs, i would like to disable and have mesh with no TLS. Is it not possible to disable mTLS ? How can it be reproduced?Please see above in the What's the issue section Logs, error output, etcError: UPGRADE FAILED: template: linkerd2/templates/proxy-injector.yaml:8:3: executing "linkerd2/templates/proxy-injector.yaml" at <include "linkerd.proxy.validation" .Values.proxy>: error calling include: template: linkerd2/charts/partials/templates/_validate.tpl:3:4: executing "linkerd.proxy.validation" at <fail (printf "Can't disable identity mTLS for %s. Set '.Values.proxy.disableIdentity' to 'false'" .component)>: error calling fail: Can't disable identity mTLS for %!s(). Set '.Values.proxy.disableIdentity' to 'false' output of
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 3 replies
-
|
It is not possible to disable Linkerd's mTLS functionality in recent Linkerd versions. This additional configuration introduces complexity that we do not wish to support. Older versions of Linkerd included configuration options to disable identity/mTLS; but these configurations were untested, so your mileage may vary. |
Beta Was this translation helpful? Give feedback.
-
|
but there is an issue, if we dont disable mtls, when control plane is down, other ns meshed pod is not able to ping the meshed pod. we tested, same ns, even control is down, it is fine. but cross ns, it was somehow blocked, as i checked the packet is mtls-ed.
|
Beta Was this translation helpful? Give feedback.
-
|
yes, both 2.11 and edge is the same |
Beta Was this translation helpful? Give feedback.
-
|
If the control plane is down, it's likely a number of other things will prevent connections between meshed pods from being established, e.g service discovery. Have you tried running in HA mode to avoid control plane downtime? |
Beta Was this translation helpful? Give feedback.
-
|
Oh, I didn't know that the mTLS functionality is mandatory to use LinkerD, that is something very important that maybe they should include in the docs... for me, I really not interested in adding mTLS encryption to the internal communications of my pods, it seems extremely unnecessary for me since all internal traffic of pods is public exposed, it adds a maintenance cost in addition to communication latency that is extremely unnecessary... I was really only interested in adding LinkerD (or whatever service mesh) to improve observability and tracing of my cluster... well, maybe some other mesh solution fix better on my requirements. |
Beta Was this translation helpful? Give feedback.
-
|
https://linkerd.io/2.14/features/automatic-mtls/index.html:
How should it be interpreted if there is no way to disable mTLS at all? |
Beta Was this translation helpful? Give feedback.
It is not possible to disable Linkerd's mTLS functionality in recent Linkerd versions. This additional configuration introduces complexity that we do not wish to support.
Older versions of Linkerd included configuration options to disable identity/mTLS; but these configurations were untested, so your mileage may vary.