Oliver Gould

@jonathanasdf We should probably look into setting the fsGroup from the injector. --- Some questions we'll need to answer: * Can we replicate this configuration in k3d? Or is this...

> ### How can it be reproduced? > > 1. Deploy a cluster on 1.22.2 with 150 nodes > 2. Deploy linkerd 2.11.0 with helm chart > 3. Create workload...

>i see some high response times for certain outbound calls.. can you please look and confirm that i am reading it correctly ? > for example: > ``` > tcp_read_bytes_total{direction="outbound",peer="dst",authority="kubernetes.default.svc.cluster.local:443",target_addr="52.191.88.164:443",target_ip="52.191.88.164",target_port="443",tls="no_identity",no_tls_reason="not_provided_by_service_discovery",dst_namespace="default",dst_service="kubernetes"} ...

This would probably have to apply to other webhooks as well. Though, in some cases we have multiple webhook containers in a single pod, so it wouldn't be possible for...

This is most likely a problem that will have to be solved in https://github.com/Arnavion/k8s-openapi and, ultimately, in the Kubernetes API spec. Since the API spec does not describe the field...

Potentially related to https://github.com/kubernetes/kubernetes/issues/93903

In Linkerd 2.12, you can now configure proxy-init to use `iptables-nft`: https://linkerd.io/2.12/features/nft/

`kubectl describe` on the pod or deployment should help make it clearer which container is crashing and potentially why. There's nothing that looks like a crash in the `destination` controller's...

OK, so the controller's probes are timing out. Does this really only happen on the destination controller and no other pods? You could try running the destination controller's proxy with...

@Anthony-Bible Hm, I'm not sure. I don't think we've tested this configuration explicitly. It's possible the IPVS kube proxy isn't working well with Linkerd's proxy-init iptables rules? I think your...