Skip to content

Exclude linkerd-proxy sidecar ports from port discovery - #1955

Merged
aryan9600 merged 1 commit into
fluxcd:mainfrom
pujitha24:auto/issue-1345
Aug 2, 2026
Merged

Exclude linkerd-proxy sidecar ports from port discovery#1955
aryan9600 merged 1 commit into
fluxcd:mainfrom
pujitha24:auto/issue-1345

Conversation

@pujitha24

Copy link
Copy Markdown
Contributor

Motivation:
When canary.spec.service.portDiscovery is enabled, Flagger scans the
target Deployment/DaemonSet containers and adds any extra container
ports to the generated canary/primary/apex Services, so multi-port
apps stay reachable. The exclusion list used to skip mesh sidecars
only knew about Istio's container names ("istio-proxy", "envoy").
Linkerd's proxy injector uses the container name "linkerd-proxy", so
its internal ports (e.g. 4143 inbound, 4191 admin) were treated as
application ports and added to the generated Services instead of
being skipped. This was reported as a comment on #1345: "portDiscovery
does not work for linkerd" (using portDiscovery on a linkerd-meshed
deployment).

Note this does not address the original report in #1345, which does
not enable portDiscovery at all — dropping ports that only exist on a
pre-existing Service (and are not declared as container ports) is a
separate, broader problem that needs its own design discussion.

Approach:
Add "linkerd-proxy" to the sidecars exclusion map in
pkg/canary/util.go, matching how "istio-proxy" and "envoy" are
already excluded from getPorts().

Validation:
Added TestGetPortsExcludesSidecars to pkg/canary/util_test.go,
asserting that getPorts() drops linkerd-proxy and istio-proxy
container ports while keeping a regular app container's extra port.

go build ./...
go test ./pkg/canary/... -run TestGetPortsExcludesSidecars -v

Both passed. Also ran the full pkg/canary test suite (go test
./pkg/canary/...) with no regressions.

Fixes #1345

Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com

Motivation:
When canary.spec.service.portDiscovery is enabled, Flagger scans the
target Deployment/DaemonSet containers and adds any extra container
ports to the generated canary/primary/apex Services, so multi-port
apps stay reachable. The exclusion list used to skip mesh sidecars
only knew about Istio's container names ("istio-proxy", "envoy").
Linkerd's proxy injector uses the container name "linkerd-proxy", so
its internal ports (e.g. 4143 inbound, 4191 admin) were treated as
application ports and added to the generated Services instead of
being skipped. This was reported as a comment on fluxcd#1345: "portDiscovery
does not work for linkerd" (using portDiscovery on a linkerd-meshed
deployment).

Note this does not address the original report in fluxcd#1345, which does
not enable portDiscovery at all — dropping ports that only exist on a
pre-existing Service (and are not declared as container ports) is a
separate, broader problem that needs its own design discussion.

Approach:
Add "linkerd-proxy" to the sidecars exclusion map in
pkg/canary/util.go, matching how "istio-proxy" and "envoy" are
already excluded from getPorts().

Validation:
Added TestGetPortsExcludesSidecars to pkg/canary/util_test.go,
asserting that getPorts() drops linkerd-proxy and istio-proxy
container ports while keeping a regular app container's extra port.

  go build ./...
  go test ./pkg/canary/... -run TestGetPortsExcludesSidecars -v

Both passed. Also ran the full pkg/canary test suite (go test
./pkg/canary/...) with no regressions.

Fixes fluxcd#1345

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
@codecov-commenter

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.15%. Comparing base (122fe97) to head (cf6cb64).
⚠️ Report is 30 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1955      +/-   ##
==========================================
+ Coverage   29.78%   30.15%   +0.37%     
==========================================
  Files         288      288              
  Lines       18591    18641      +50     
==========================================
+ Hits         5537     5622      +85     
+ Misses      12325    12282      -43     
- Partials      729      737       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@aryan9600

Copy link
Copy Markdown
Member

lgtm! 🏅

@aryan9600
aryan9600 merged commit 2e0debd into fluxcd:main Aug 2, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

canary activation removes unspecified ports from the pre-existing service

3 participants