Skip to content

chore(injector): promote native sidecars to beta #14587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 7, 2025
Merged

chore(injector): promote native sidecars to beta #14587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6817c2
chore(injector): promote native sidecars to beta
alpeb Oct 7, 2025
7c6bdf8
Lint
alpeb Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/linkerd-control-plane/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,7 @@ proxy:
# -- Configures the outbound transport mode. Valid values are "transport-header" and "transparent"
outboundTransportMode: transport-header
# -- Enable KEP-753 native sidecars
# This is an experimental feature. It requires Kubernetes >= 1.29.
# This is a beta feature. It requires Kubernetes >= 1.29.
# If enabled, .proxy.waitBeforeExitSeconds should not be used.
nativeSidecar: false
# -- Native sidecar proxy startup probe parameters.
Expand Down
8 changes: 6 additions & 2 deletions cli/cmd/doc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,8 +289,12 @@ func generateAnnotationsDocs() []annotationDoc {
Description: "Grace period for graceful proxy shutdowns. If this timeout elapses before all open connections have completed, the proxy will terminate forcefully, closing any remaining connections.",
},
{
Name: k8s.ProxyEnableNativeSidecarAnnotation,
Description: "Enable KEP-753 native sidecars. This is an experimental feature. It requires Kubernetes >= 1.29. If enabled, .proxy.waitBeforeExitSeconds should not be used.",
Name: k8s.ProxyEnableNativeSidecarAnnotationAlpha,
Description: "Enable KEP-753 native sidecars. This is a beta feature. It requires Kubernetes >= 1.29. If enabled, .proxy.waitBeforeExitSeconds should not be used. Deprecated in favor of " + k8s.ProxyEnableNativeSidecarAnnotationBeta,
},
{
Name: k8s.ProxyEnableNativeSidecarAnnotationBeta,
Description: "Enable KEP-753 native sidecars. This is a beta feature. It requires Kubernetes >= 1.29. If enabled, .proxy.waitBeforeExitSeconds should not be used.",
},
}
}
2 changes: 1 addition & 1 deletion cli/cmd/inject.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -505,7 +505,7 @@ func getOverrideAnnotations(values *linkerd2.Values, base *linkerd2.Values) map[
}

if proxy.NativeSidecar != baseProxy.NativeSidecar {
overrideAnnotations[k8s.ProxyEnableNativeSidecarAnnotation] = strconv.FormatBool(proxy.NativeSidecar)
overrideAnnotations[k8s.ProxyEnableNativeSidecarAnnotationBeta] = strconv.FormatBool(proxy.NativeSidecar)
}

return overrideAnnotations
Expand Down
20 changes: 10 additions & 10 deletions cli/cmd/inject_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -739,16 +739,16 @@ func TestProxyConfigurationAnnotations(t *testing.T) {
k8s.ProxyLogLevelAnnotation: "debug",
k8s.ProxyLogFormatAnnotation: "cool",

k8s.ProxyEnableExternalProfilesAnnotation: "true",
k8s.ProxyCPURequestAnnotation: "10m",
k8s.ProxyCPULimitAnnotation: "100m",
k8s.ProxyMemoryRequestAnnotation: "10Mi",
k8s.ProxyMemoryLimitAnnotation: "50Mi",
k8s.ProxyWaitBeforeExitSecondsAnnotation: "10",
k8s.ProxyAwait: "disabled",
k8s.ProxyAccessLogAnnotation: "apache",
k8s.ProxyShutdownGracePeriodAnnotation: "60s",
k8s.ProxyEnableNativeSidecarAnnotation: "true",
k8s.ProxyEnableExternalProfilesAnnotation: "true",
k8s.ProxyCPURequestAnnotation: "10m",
k8s.ProxyCPULimitAnnotation: "100m",
k8s.ProxyMemoryRequestAnnotation: "10Mi",
k8s.ProxyMemoryLimitAnnotation: "50Mi",
k8s.ProxyWaitBeforeExitSecondsAnnotation: "10",
k8s.ProxyAwait: "disabled",
k8s.ProxyAccessLogAnnotation: "apache",
k8s.ProxyShutdownGracePeriodAnnotation: "60s",
k8s.ProxyEnableNativeSidecarAnnotationBeta: "true",
}

overrides := getOverrideAnnotations(values, baseValues)
Expand Down
2 changes: 1 addition & 1 deletion cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 9 additions & 3 deletions pkg/inject/inject.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ var (
rTrail = regexp.MustCompile(`\},\s*\]`)

// ProxyAnnotations is the list of possible annotations that can be applied on a pod or namespace.
// All these annotations should be prefixed with "config.linkerd.io"
ProxyAnnotations = []string{
k8s.ProxyAdminPortAnnotation,
k8s.ProxyControlPortAnnotation,
Expand Down Expand Up @@ -81,12 +80,13 @@ var (
k8s.ProxyInboundDiscoveryCacheUnusedTimeout,
k8s.ProxyDisableOutboundProtocolDetectTimeout,
k8s.ProxyDisableInboundProtocolDetectTimeout,
k8s.ProxyEnableNativeSidecarAnnotationBeta,
}
// ProxyAlphaConfigAnnotations is the list of all alpha configuration
// (config.alpha prefix) that can be applied to a pod or namespace.
ProxyAlphaConfigAnnotations = []string{
k8s.ProxyWaitBeforeExitSecondsAnnotation,
k8s.ProxyEnableNativeSidecarAnnotation,
k8s.ProxyEnableNativeSidecarAnnotationAlpha,
}
)

Expand Down Expand Up @@ -372,7 +372,13 @@ func ApplyAnnotationOverrides(values *l5dcharts.Values, annotations map[string]s
}
}

if override, ok := annotations[k8s.ProxyEnableNativeSidecarAnnotation]; ok {
// ProxyEnableNativeSidecarAnnotationBeta should take precedence over ProxyEnableNativeSidecarAnnotationAlpha
if override, ok := annotations[k8s.ProxyEnableNativeSidecarAnnotationBeta]; ok {
value, err := strconv.ParseBool(override)
if err == nil {
values.Proxy.NativeSidecar = value
}
} else if override, ok = annotations[k8s.ProxyEnableNativeSidecarAnnotationAlpha]; ok {
value, err := strconv.ParseBool(override)
if err == nil {
values.Proxy.NativeSidecar = value
Expand Down
4 changes: 2 additions & 2 deletions pkg/inject/inject_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ func TestGetOverriddenValues(t *testing.T) {
k8s.ProxyInboundDiscoveryCacheUnusedTimeout: "900s",
k8s.ProxyDisableOutboundProtocolDetectTimeout: "true",
k8s.ProxyDisableInboundProtocolDetectTimeout: "true",
k8s.ProxyEnableNativeSidecarAnnotation: "true",
k8s.ProxyEnableNativeSidecarAnnotationBeta: "true",
},
},
Spec: corev1.PodSpec{},
Expand Down Expand Up @@ -179,7 +179,7 @@ func TestGetOverriddenValues(t *testing.T) {
k8s.ProxyInboundDiscoveryCacheUnusedTimeout: "6000ms",
k8s.ProxyDisableOutboundProtocolDetectTimeout: "true",
k8s.ProxyDisableInboundProtocolDetectTimeout: "false",
k8s.ProxyEnableNativeSidecarAnnotation: "true",
k8s.ProxyEnableNativeSidecarAnnotationBeta: "true",
},
spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Expand Down
11 changes: 9 additions & 2 deletions pkg/k8s/labels.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,9 @@ const (
// ProxyConfigAnnotationsPrefixAlpha is the prefix of newly released config-related annotations
ProxyConfigAnnotationsPrefixAlpha = "config.alpha.linkerd.io"

// ProxyConfigAnnotationsPrefixBeta is the prefix for config-related annotations more mature than alpha but not yet stable
ProxyConfigAnnotationsPrefixBeta = "config.beta.linkerd.io"

// ProxyImageAnnotation can be used to override the proxyImage config.
ProxyImageAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-image"

Expand Down Expand Up @@ -283,8 +286,12 @@ const (
// configured for the Pod
ProxyWaitBeforeExitSecondsAnnotation = ProxyConfigAnnotationsPrefixAlpha + "/proxy-wait-before-exit-seconds"

// ProxyEnableNativeSidecarAnnotation enables the new native initContainer sidecar
ProxyEnableNativeSidecarAnnotation = ProxyConfigAnnotationsPrefixAlpha + "/proxy-enable-native-sidecar"
// ProxyEnableNativeSidecarAnnotationAlpha enables the new native initContainer sidecar.
// Deprecated: use ProxyEnableNativeSidecarAnnotationBeta instead.
ProxyEnableNativeSidecarAnnotationAlpha = ProxyConfigAnnotationsPrefixAlpha + "/proxy-enable-native-sidecar"

// ProxyEnableNativeSidecarAnnotationBeta enables the new native initContainer sidecar
ProxyEnableNativeSidecarAnnotationBeta = ProxyConfigAnnotationsPrefixBeta + "/proxy-enable-native-sidecar"

// ProxyAwait can be used to force the application to wait for the proxy
// to be ready.
Expand Down