Linkerd2-proxy is a transparent proxy component for the Linkerd service mesh, written in Rust.
The proxy solves the problem of adding observability, security, and intelligent routing to microservices without requiring application code changes. It operates transparently in Kubernetes and containerized environments, intercepting traffic at the network layer. The tool handles HTTP, HTTP/2, WebSocket, and arbitrary TCP protocols with zero-config setup. It automatically exports Prometheus metrics for both HTTP and TCP traffic, performs latency-aware layer-7 load balancing for HTTP workloads and layer-4 load balancing for non-HTTP traffic, enforces mutual TLS encryption between services, and provides an on-demand diagnostic tap API for traffic inspection. Service discovery is handled through DNS or the Linkerd Destination gRPC API.
Adoption suits teams running Kubernetes clusters who want to add service mesh capabilities without modifying applications. The proxy is designed specifically for Linux containerized environments, though it may work on other Unix-like systems. It is part of the CNCF-hosted Linkerd project and integrates as the data plane component of the broader Linkerd2 control plane.
The project is organized into multiple independent Rust crates to enable isolated compilation and testing. Development infrastructure includes a justfile for automating build tasks, a dev container for standardized local setup, and comprehensive testing through unit tests, integration tests, and fuzzing. Security has been validated through third-party fuzzing audits.
