feat(cli): add default outbound policy support - #15617
Open
gnarlex wants to merge 4 commits into
Open
Conversation
gnarlex
force-pushed
the
alex/outbound-default-policy-validation
branch
from
August 28, 2026 15:25
0877db6 to
34a9f6e
Compare
Add the control-plane surface for the proxy's outbound default policy (`LINKERD2_PROXY_OUTBOUND_DEFAULT_POLICY`), mirroring the existing inbound default policy: the `proxy.defaultOutboundPolicy` Helm value, the `--default-outbound-policy` CLI flag, and the `config.linkerd.io/default-outbound-policy` pod annotation, all injected onto proxy containers via the shared proxy partial. Control-plane components (destination, identity, proxy-injector) pin the value to `all-unauthenticated` so a restrictive global default cannot lock out the control plane. The proxy implements the outbound default policy as an mTLS requirement enforced at connect time on resolved endpoints, and only supports a three-value subset of the inbound vocabulary: - `all-unauthenticated` (default): permit cleartext to unmeshed targets; byte-for-byte unchanged from today's behavior. - `all-authenticated`: require a mesh identity (mTLS) for every outbound endpoint. - `cluster-authenticated`: require a mesh identity only for endpoints within clusterNetworks. Validation for the `--default-outbound-policy` flag and the `config.linkerd.io/default-outbound-policy` annotation is therefore narrowed to that subset; `deny`, `cluster-unauthenticated` and `audit` remain inbound-only. The Helm values documentation is updated to match. Inbound policy validation is unchanged. Enforcement of `all-authenticated`/`cluster-authenticated` across multiple control planes additionally requires relaxing the destination controller's identity-advertisement gate; that is deliberately left as a follow-up. Relates to linkerd#15615 Relates to linkerd/linkerd2-proxy#4617 Signed-off-by: Alexander Klein <hello@gnarlex.com>
gnarlex
force-pushed
the
alex/outbound-default-policy-validation
branch
from
August 28, 2026 15:31
34a9f6e to
39925e4
Compare
thesw4rm
reviewed
Aug 31, 2026
gnarlex
marked this pull request as ready for review
August 31, 2026 13:39
Signed-off-by: Alexander Klein <hello@gnarlex.com>
Signed-off-by: Alexander Klein <hello@gnarlex.com>
gnarlex
force-pushed
the
alex/outbound-default-policy-validation
branch
from
August 31, 2026 15:41
4306fa4 to
87e037d
Compare
thesw4rm
reviewed
Aug 31, 2026
thesw4rm
reviewed
Aug 31, 2026
Signed-off-by: Alexander Klein <hello@gnarlex.com>
gnarlex
force-pushed
the
alex/outbound-default-policy-validation
branch
from
September 1, 2026 07:27
01d3dcb to
da20a53
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add the control-plane surface for the proxy's outbound default policy (
LINKERD2_PROXY_OUTBOUND_DEFAULT_POLICY), mirroring the existing inbound default policy: theproxy.defaultOutboundPolicyHelm value, the--default-outbound-policyCLI flag, and theconfig.linkerd.io/default-outbound-policypod annotation, all injected onto proxy containers via the shared proxy partial. Control-plane components (destination, identity, proxy-injector) pin the value toall-unauthenticatedso a restrictive global default cannot lock out the control plane.The proxy implements the outbound default policy as an mTLS requirement enforced at connect time on resolved endpoints, and only supports a three-value subset of the inbound vocabulary:
all-unauthenticated(default): permit cleartext to unmeshed targets; byte-for-byte unchanged from today's behavior.all-authenticated: require a mesh identity (mTLS) for every outbound endpoint.cluster-authenticated: require a mesh identity only for endpoints within clusterNetworks.Validation for the
--default-outbound-policyflag and theconfig.linkerd.io/default-outbound-policyannotation is therefore narrowed to that subset;deny,cluster-unauthenticatedandauditremain inbound-only. The Helm values documentation is updated to match. Inbound policy validation is unchanged.Enforcement of
all-authenticated/cluster-authenticatedacross multiple control planes additionally requires relaxing the destination controller's identity-advertisement gate; that is deliberately left as a follow-up.Relates to #15615 and linkerd/linkerd2-proxy#4617.