Linkerd - stable-2.11.2

stable-2.11.2

This release pulls in many small fixes and improvements from the main
development branch. It features changes to the multicluster extension to
support the new linkerd-failover extension so that clients can
failover across services hosted on remote clusters.

• CLI
• Updated check to avoid checking the proxy version of uninjected pods
• Updated check to skip evicted pods

• Updated extension install commands to support the --ignore-cluster flag

• Core

• Fixed a bug in the destination controller that could prevent service
  endpoint updates from being sent to the proxy
• Updated the destination controller to honor Server resources when
  determining an endpoint's opaqueness
• Updated the proxy to correctly honor opaque protocol hints for
  non-Kubernetes targets, i.e., when a workload's
  config.linkerd.io/enable-external-profiles annotation is set to true
• Updated controller webhook servers to ensure that TLS v1.2 or greater is
  used
• Disabled pprof in control plane admin endpoints by default
• Updated controllers to ensure that user input is quoted & escaped
  in log messages
• Updated the proxy's linkerd-await post-start hook to timeout after 2
  minutes. This makes it easier to debug proxies that fail to become ready
• Updated the proxy init container to support JSON log formatting
• Added a config.linkerd.io/skip-subnets workload annotation that can be
  used to configure the proxy-init to skip rewriting all traffic to a given
  subnet. This is primarily intended to support docker-in-docker deployments
• Updated the policy controller to use an openssl backend for its admission
  controller server on x86_64 to improve interopability with more exotic
  Kubernetes server configurations
• Updated the policy controller to dynamically reload its webhook server
  credentials without restarting
• Updated the Server CRD to relax OpenAPI schema validation requirements
• Updated the policy controller webhook server to enforce validation of
  Server and ServerAuthorization resources
• Added a proxyInit.runAsRoot helm variable that may be set to false to run
  the proxy-init container as a non-root user
• Updated controller servers to limit the amount of data that may be buffered
  to guard against malicious clients

• Removed use of the deprecated beta.kubernetes.io/node label

• Jaeger

• Upgraded jaeger to v1.31 and opentelemetry-collector to v0.43 to support
  ARM

• Multicluster

• Updated service mirrors so that local services reflect the
  readiness of the remote service. When the remote service has no ready
  endpoints or when its gateway is unavailable, the mirrored local service
  will also have no ready endpoints
• Fixed a configuration issue that prevented multicluster gateways from
  running on ARM nodes
• Updated multicluster service mirrors to only create mirrored services when
  the service's namespace already exists in the local cluster
• Fixed a bug that prevented WebSocket requests from being routed by gateways
• Updated the linkerd-multicluster-link Helm chart so that a RoleBinding
  is created for each target cluster. This role binding is now only created
  when the enablePSP helm value is set to true
• Added a linkerd multicluster install --ha flag to run gateways with
  multiple replicas, pod disruption budgets, anti-affinity settings, etc