linkerd

Renders Linkerd Servers, authorization policies, authentications, HTTPRoutes and ServiceProfiles from inventory parameters.

kubernetes networking security

Latest: 1.0.2 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 17 · 378 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/linkerd/badge.json)](https://kadet-hub.org/generators/linkerd/)

Linkerd Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for Linkerd policy resources. Built for Linkerd edge-26.10.1. Its CRDs are unchanged from edge-26.6.3, the edge release of Linkerd 2.20.

Server (policy.linkerd.io/v1beta3): a port on a set of pods that policy applies to
ServerAuthorization (policy.linkerd.io/v1beta1): clients allowed to reach a Server
AuthorizationPolicy (policy.linkerd.io/v1alpha1): authentications required for a Server, HTTPRoute or namespace
MeshTLSAuthentication (policy.linkerd.io/v1alpha1): a set of mesh identities
NetworkAuthentication (policy.linkerd.io/v1alpha1): a set of client networks
HTTPRoute (policy.linkerd.io/v1beta3): HTTP route attached to a Server
ServiceProfile (linkerd.io/v1alpha2): per-route metrics, retries and timeouts of a Service

The Linkerd install belongs in the helm input with the upstream linkerd-crds and linkerd-control-plane charts. Gateway API routes (gateway.networking.k8s.io) are not rendered.

Server and HTTPRoute are emitted as v1beta3, the storage versions; Linkerd marks v1beta1 deprecated (CRD). The Linkerd docs describe AuthorizationPolicy as the replacement for ServerAuthorization.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/linkerd@sha256:<digest>
        output_path: lib/linkerd
    compile:
      - output_path: manifests/linkerd/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/linkerd

Inventory Contract

All keys live under parameters.generators.linkerd.

Key	Kind	Output key
`namespace`		Default namespace. Falls back to `parameters.namespace`, then `default`.
`servers.<name>`	Server	`<namespace>/<name>-server`
`server_authorizations.<name>`	ServerAuthorization	`<namespace>/<name>-serverauth`
`authorization_policies.<name>`	AuthorizationPolicy	`<namespace>/<name>-authpolicy`
`meshtls_authentications.<name>`	MeshTLSAuthentication	`<namespace>/<name>-meshtlsauth`
`network_authentications.<name>`	NetworkAuthentication	`<namespace>/<name>-networkauth`
`http_routes.<name>`	HTTPRoute	`<namespace>/<name>-httproute`
`service_profiles.<name>`	ServiceProfile	`<namespace>/<name>-serviceprofile`

Every resource accepts namespace, labels, annotations and spec, and gets the label name: <name>; a Server also gets server: <name>. Precedence is generator defaults < spec < flat keys and shorthands: a flat key that overrides the same field in spec wins and logs a warning.

Kind	Flat key	Renders to
Server	`selector_labels`	`spec.podSelector.matchLabels`
Server	`port`	`spec.port`, a number or a container port name
ServerAuthorization	`selector_labels`	`spec.server.selector.matchLabels`
ServerAuthorization	`client`	`spec.client`
AuthorizationPolicy	`target_ref`	`spec.targetRef`; a string names a Server
AuthorizationPolicy	`required_authentication_refs`	`spec.requiredAuthenticationRefs`; a string names an entry of `meshtls_authentications` or `network_authentications`
MeshTLSAuthentication	`identities`	`spec.identities`
MeshTLSAuthentication	`identity_refs`	`spec.identityRefs`; a string names a ServiceAccount
NetworkAuthentication	`networks`	`spec.networks`; a string is a CIDR

HTTPRoute and ServiceProfile take spec verbatim. A ServiceProfile name must be the fully qualified name of its Service, such as api.api-namespace.svc.cluster.local.

A Server needs selector_labels or spec.podSelector; the compile fails otherwise, because an empty selector matches every pod in the namespace.

Shorthands and defaults

Input	Result
`target_ref: <name>`	`{group: policy.linkerd.io, kind: Server, name: <name>}`
`required_authentication_refs: [<name>]`	`{group: policy.linkerd.io, kind: MeshTLSAuthentication or NetworkAuthentication, name: <name>}`, plus `namespace` when the entry is in another namespace than the policy
`identity_refs: [<name>]`	`{kind: ServiceAccount, name: <name>}`, a ServiceAccount in the namespace of the MeshTLSAuthentication
`networks: [<cidr>]`	`{cidr: <cidr>}`
a `targetRef` or `requiredAuthenticationRefs` entry of kind `Server`, `MeshTLSAuthentication` or `NetworkAuthentication` without `group`	`group: policy.linkerd.io`

Dicts pass through, for example target_ref: {group: policy.linkerd.io, kind: HTTPRoute, name: x}, target_ref: {kind: Namespace, name: <namespace>} or a {kind: ServiceAccount, name: x} authentication. A string in required_authentication_refs that matches no entry, or entries in both sections, fails the compile with ValueError.

The group default exists because Linkerd reads a missing group as the core API group (targets_kind). A targetRef of {kind: Server, name: x} then names no supported kind (accepted kinds), and the policy admission webhook rejects the AuthorizationPolicy (admission). The three kinds exist only in policy.linkerd.io; HTTPRoute also exists in gateway.networking.k8s.io and gets no group. The ServiceAccount reference resolves to the namespace of the MeshTLSAuthentication when namespace is unset (identityRefs). The expanded forms are those of the authorization policy reference.

Values the CRD or the controller already default are not emitted: Server proxyProtocol (unknown) and accessPolicy (deny), and the HTTPRoute parentRefs group, which the CRD defaults to policy.linkerd.io (CRD).

Example

parameters:
  generators:
    linkerd:
      namespace: booksapp
      servers:
        authors:
          selector_labels:
            app: authors
          port: service
      meshtls_authentications:
        webapp:
          identity_refs: [webapp]
      network_authentications:
        cluster-network:
          networks: [10.0.0.0/8]
      authorization_policies:
        authors-webapp:
          target_ref: authors
          required_authentication_refs: [webapp]
        authors-probes:
          target_ref: authors
          required_authentication_refs: [cluster-network]
      http_routes:
        authors-get:
          spec:
            parentRefs:
              - name: authors
                kind: Server
                group: policy.linkerd.io
            rules:
              - matches:
                  - path:
                      type: PathPrefix
                      value: /authors
                    method: GET

This renders booksapp/authors-server, booksapp/webapp-meshtlsauth, booksapp/cluster-network-networkauth, booksapp/authors-webapp-authpolicy, booksapp/authors-probes-authpolicy and booksapp/authors-get-httproute. Both AuthorizationPolicies target the Server with group: policy.linkerd.io, and authors-webapp requires the MeshTLSAuthentication webapp, which authenticates the webapp ServiceAccount.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.2	Linkerd edge-26.10.1
1.0.1	Linkerd edge-26.6.3
1.0.0	Linkerd edge-26.6.3

1.0.2# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/linkerd:1.0.2@sha256:debcd42bbe2e94d2bf06b952e12fd430588a5b2803bea99a102adae1ab2c0ad8
        output_path: lib/linkerd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/linkerd@sha256:debcd42bbe2e94d2bf06b952e12fd430588a5b2803bea99a102adae1ab2c0ad8 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3275155724, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): Linkerd edge-26.10.1
Source: linkerd-v1.0.2 · f7c9a3bbdc92f6d8de2cdefb8bd677fbaac646d5 · linkerd
Binaries: none
Output capabilities: none
Digest: sha256:debcd42bbe2e94d2bf06b952e12fd430588a5b2803bea99a102adae1ab2c0ad8

Checks

Checked by the release run on 2026-10-16, gate at 27448d11deef.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.1: 0 files, 0 hunks.

Output diff

1.0.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/linkerd:1.0.1@sha256:456bead1c9443312a56c7eb540dc21e6dfcd584cb95af29fa4920c9d2f8082e9
        output_path: lib/linkerd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/linkerd@sha256:456bead1c9443312a56c7eb540dc21e6dfcd584cb95af29fa4920c9d2f8082e9 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244141906, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Linkerd edge-26.6.3
Source: linkerd-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · linkerd
Binaries: none
Output capabilities: none
Digest: sha256:456bead1c9443312a56c7eb540dc21e6dfcd584cb95af29fa4920c9d2f8082e9

Checks

Checked by the release run on 2026-10-13, gate at ba634ff54963.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/linkerd:1.0.0@sha256:b2ca9c69e17c46546f596319c4a4ff5f500bf4d1d0270c3ea119e8a1aa46f439
        output_path: lib/linkerd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/linkerd@sha256:b2ca9c69e17c46546f596319c4a4ff5f500bf4d1d0270c3ea119e8a1aa46f439 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3211071566, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Linkerd edge-26.6.3
Source: linkerd-v1.0.0 · 91b3915d464dd9327ffce043f5ae528c26de7dff · linkerd
Binaries: none
Output capabilities: none
Digest: sha256:b2ca9c69e17c46546f596319c4a4ff5f500bf4d1d0270c3ea119e8a1aa46f439

Checks

Checked by the release run on 2026-10-11, gate at 53cd4d009ae5.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.