Install Linkerd on a kind cluster, inject a sidecar, and see mTLS and golden metrics light up

Getting Started

Linkerd is the gentle introduction to service meshes — fewer moving parts than Istio, fast to install, and the demo app shows the value in five minutes. This page boots Linkerd on a local cluster, meshes a sample app, and walks you through what just happened.

For Istio's equivalent, see Istio vs Linkerd.

Prerequisites

A working Kubernetes cluster — kind, minikube, or any cloud cluster. See K8s getting started.
kubectl configured against it.

# Quick kind cluster
kind create cluster --name mesh
kubectl get nodes

Install the Linkerd CLI

# macOS / Linux
curl -fsSL https://run.linkerd.io/install | sh
export PATH="$HOME/.linkerd2/bin:$PATH"

linkerd version --client

Pre-flight Check

Linkerd ships a pre-flight check that verifies your cluster can host it:

linkerd check --pre

Fix anything that fails before continuing.

Install Linkerd

Linkerd installs in two parts — CRDs first, then the control plane:

linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Wait for it to be healthy
linkerd check

linkerd check is your best friend — it walks every component and tells you what's wrong if anything is.

Install the Viz Extension (Dashboards & Metrics)

Linkerd's main package is intentionally tiny; everything else is an extension:

linkerd viz install | kubectl apply -f -
linkerd check

# Open the dashboard (tunnels via kubectl port-forward)
linkerd viz dashboard &

The dashboard shows mTLS status, success rates, and live traffic per service.

Deploy and Mesh the Demo App

Linkerd ships an "emojivoto" demo app:

# Deploy the unmeshed app
kubectl apply -f https://run.linkerd.io/emojivoto.yml

# Inject Linkerd sidecars into every pod in the namespace
kubectl get -n emojivoto deploy -o yaml \
  | linkerd inject - \
  | kubectl apply -f -

# Check that pods now show 2 containers (app + linkerd-proxy)
kubectl -n emojivoto get pods

The injection adds an linkerd.io/inject: enabled annotation; a mutating admission webhook then adds the sidecar container at pod creation.

See the Mesh Work

# Generate traffic
kubectl -n emojivoto port-forward svc/web-svc 8080:80 &
open http://localhost:8080      # click around

# Live stats per route
linkerd viz stat -n emojivoto deploy

# Live request tap (like tcpdump but at L7)
linkerd viz tap -n emojivoto deploy/web

# See the mesh topology in the dashboard
linkerd viz dashboard

linkerd viz stat prints success rate, RPS, and P50/P95/P99 latency per workload — the golden signals, with no app code changes.

What You Get for Free

Now that pods are meshed:

Capability	How to see it
mTLS between services	`linkerd viz edges -n emojivoto deploy` — every edge shows `linkerd.io` as the secured identity
L7 metrics	`linkerd viz stat` / dashboard
Live request inspection	`linkerd viz tap`
Retries (opt-in)	Add a `ServiceProfile` and set `isRetryable: true`
Timeouts	`ServiceProfile.timeout` per route
Traffic split	`TrafficSplit` CRD — 90/10 between two service versions

Try mTLS:

linkerd viz edges -n emojivoto deploy

SRC          DST          SRC_NS    DST_NS    SECURED
vote-bot     web          emojivoto emojivoto √
web          emoji        emojivoto emojivoto √
web          voting       emojivoto emojivoto √

Every connection is now encrypted end-to-end and the proxies verify each other's identity via short-lived certificates rotated automatically.

A Traffic Split for Canary Deploys

# 90% to web-v1, 10% to web-v2
apiVersion: split.smi-spec.io/v1alpha1
kind: TrafficSplit
metadata:
  name: web-canary
  namespace: emojivoto
spec:
  service: web-svc          # the apex service
  backends:
    - service: web-v1
      weight: 90
    - service: web-v2
      weight: 10

kubectl apply -f traffic-split.yaml
linkerd viz stat ts/web-canary -n emojivoto      # see weighted flow

Add Flagger on top and the split automates itself based on success-rate and latency metrics.

Tear Down

linkerd viz uninstall   | kubectl delete -f -
linkerd uninstall       | kubectl delete -f -
kubectl delete -f https://run.linkerd.io/emojivoto.yml
kind delete cluster --name mesh

What's Next

You've installed a mesh, meshed an app, and seen mTLS + L7 metrics with zero app changes. Next:

Istio vs Linkerd — when to pick which, and what Istio's Ambient mode changes
Best Practices — production patterns: rollout strategy, sizing, when not to use

Getting Started

On this page