linkerd-tcp
A TCP load balancer for the linkerd service mesh.
Status: beta
Features
- Lightweight, native TCP and TLS load balancer built on tokio.
- Weighted-least-loaded P2C load balancing.
- Minimal resource utilization: typically <.5 cores with ~2MB RSS.
- Tightly integrated with the linkerd service mesh.
- Supports endpoint weighting (i.e. for "red line" testing).
- Modern Transport Layer Security via rustls:
- TLS1.2 and TLS1.3 (draft 18) only.
- ECDSA or RSA server authentication by clients.
- RSA server authentication by servers.
- Forward secrecy using ECDHE; with curve25519, nistp256 or nistp384 curves.
- AES128-GCM and AES256-GCM bulk encryption, with safe nonces.
- Chacha20Poly1305 bulk encryption.
- ALPN support.
- SNI support.
Quickstart
- Install Rust and Cargo.
- Configure and run namerd.
- From this repository, run:
cargo run -- example.yml
Usage
linkerd-tcp 0.1.0
A native TCP proxy for the linkerd service mesh
USAGE:
linkerd-tcp <PATH>
FLAGS:
-h, --help Prints help information
-V, --version Prints version information
ARGS:
<PATH> Config file path
Example configuration
proxies:
- label: default
servers:
# Listen on two ports, one using a self-signed TLS certificate.
- kind: io.l5d.tcp
addr: 0.0.0.0:7474
- kind: io.l5d.tls
addr: 0.0.0.0:7575
defaultIdentity:
privateKey: private.pem
certs:
- cert.pem
- ../eg-ca/ca/intermediate/certs/ca-chain.cert.pem
# Lookup /svc/google in namerd.
namerd:
addr: 127.0.0.1:4180
path: /svc/google
# Require that the downstream connection be TLS'd, with a `subjectAltName` including
# the DNS name _www.google.com_ using either our local CA or the host's default
# openssl certificate.
client:
tls:
dnsName: "www.google.com"
trustCerts:
- ../eg-ca/ca/intermediate/certs/ca-chain.cert.pem
- /usr/local/etc/openssl/cert.pem
Logging
Logging may be enabled by setting RUST_LOG=linkerd_tcp=info
on the environment. When
debugging, set RUST_LOG=trace
.
Packaging
To build the linkerd/linkerd-tcp docker image, run:
./dockerize latest
Replace latest
with the version that you want to build.
Try running the image with:
docker run -v `pwd`/example.yml:/example.yml linkerd/linkerd-tcp:latest /example.yml
License
Copyright 2017, Buoyant Inc. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use these files except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.