linkerd · alpeb · Apr 22, 2020 · Mar 25, 2020 · Mar 25, 2020 · Mar 25, 2020
diff --git a/charts/add-ons/tracing/templates/tracing.yaml b/charts/add-ons/tracing/templates/tracing.yaml
@@ -93,6 +93,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: {{.Values.collector.name}}
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       containers:
@@ -135,6 +136,9 @@ spec:
             path: linkerd-collector-config.yaml
           name: {{printf "%s-config" .Values.collector.name}}
         name: {{ printf "%s-config-val" .Values.collector.name}}
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
 ---
 ###
@@ -198,6 +202,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: {{.Values.jaeger.name}}
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       containers:
@@ -220,4 +225,7 @@ spec:
       dnsPolicy: ClusterFirst
       serviceAccountName: linkerd-jaeger
       volumes:
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/controller.yaml b/charts/linkerd2/templates/controller.yaml
@@ -58,6 +58,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: controller
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -109,4 +110,7 @@ spec:
       - configMap:
           name: linkerd-config
         name: config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/destination.yaml b/charts/linkerd2/templates/destination.yaml
@@ -58,6 +58,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: destination
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -109,4 +110,7 @@ spec:
       - configMap:
           name: linkerd-config
         name: config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/grafana.yaml b/charts/linkerd2/templates/grafana.yaml
@@ -113,6 +113,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: grafana
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -165,4 +166,7 @@ spec:
             path: provisioning/dashboards/dashboards.yaml
           name: linkerd-grafana-config
         name: grafana-config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/heartbeat.yaml b/charts/linkerd2/templates/heartbeat.yaml
@@ -26,6 +26,7 @@ spec:
         metadata:
           labels:
             {{.Values.global.controllerComponentLabel}}: heartbeat
+            {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
           annotations:
             {{.Values.global.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.global.linkerdVersion) .Values.global.cliVersion}}
         spec:

diff --git a/charts/linkerd2/templates/identity.yaml b/charts/linkerd2/templates/identity.yaml
@@ -78,6 +78,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: identity
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -131,5 +132,8 @@ spec:
       - name: identity-issuer
         secret:
           secretName: linkerd-identity-issuer
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
 {{end -}}
diff --git a/charts/linkerd2/templates/prometheus.yaml b/charts/linkerd2/templates/prometheus.yaml
@@ -186,6 +186,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: prometheus
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -236,4 +237,7 @@ spec:
       - configMap:
           name: linkerd-prometheus-config
         name: prometheus-config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/proxy-injector.yaml b/charts/linkerd2/templates/proxy-injector.yaml
@@ -40,6 +40,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: proxy-injector
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -93,6 +94,9 @@ spec:
       - name: tls
         secret:
           secretName: linkerd-proxy-injector-tls
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
 ---
 kind: Service

diff --git a/charts/linkerd2/templates/smi-metrics.yaml b/charts/linkerd2/templates/smi-metrics.yaml
@@ -45,6 +45,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: smi-metrics
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -85,6 +86,9 @@ spec:
       {{ end -}}
 
       volumes:
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - name: config
         configMap:
           name: linkerd-smi-metrics

diff --git a/charts/linkerd2/templates/sp-validator.yaml b/charts/linkerd2/templates/sp-validator.yaml
@@ -59,6 +59,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: sp-validator
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -107,4 +108,7 @@ spec:
       - name: tls
         secret:
           secretName: linkerd-sp-validator-tls
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/tap.yaml b/charts/linkerd2/templates/tap.yaml
@@ -64,6 +64,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: tap
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -118,6 +119,9 @@ spec:
       - configMap:
           name: linkerd-config
         name: config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
       - name: tls
         secret:

diff --git a/charts/linkerd2/templates/web.yaml b/charts/linkerd2/templates/web.yaml
@@ -56,6 +56,7 @@ spec:
       labels:
         {{.Values.global.controllerComponentLabel}}: web
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
+        {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
         {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
     spec:
       {{- include "linkerd.node-selector" . | nindent 6 }}
@@ -109,4 +110,7 @@ spec:
       - configMap:
           name: linkerd-config
         name: config
+      {{ if .Values.global.controlPlaneTracing -}}
+      - {{- include "partials.proxy.volumes.labels" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      {{ end -}}
       - {{- include "partials.proxy.volumes.identity" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
@@ -74,6 +74,7 @@ global:
   controllerComponentLabel: linkerd.io/control-plane-component
   controllerNamespaceLabel: linkerd.io/control-plane-ns
   linkerdNamespaceLabel: linkerd.io/is-control-plane
+  workloadNamespaceLabel: linkerd.io/workload-ns
 
 # enforced host validation regular expression
 enforcedHostRegexp: ""

diff --git a/charts/partials/templates/_metadata.tpl b/charts/partials/templates/_metadata.tpl
@@ -3,6 +3,10 @@ linkerd.io/identity-mode: {{ternary "default" "disabled" (not .disableIdentity)}
 linkerd.io/proxy-version: {{.image.version}}
 {{- end -}}
 
+{{/*
+To add labels to the control-plane components, instead update at induvidual component manifests as
+adding here would also update `spec.selector.matchLabels` which are immutable and would fail upgrades.
+*/}}
 {{- define "partials.proxy.labels" -}}
 linkerd.io/proxy-{{.workloadKind}}: {{.component}}
 {{- end -}}
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
@@ -22,6 +22,10 @@ env:
   value: 10000ms
 - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
   value: 10000ms
+{{ if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing) -}}
+- name: LINKERD2_PROXY_TRACE_ATTRIBUTES_PATH
+  value: /var/run/linkerd/podinfo/labels
+{{ end -}}
 - name: _pod_ns
   valueFrom:
     fieldRef:
@@ -73,14 +77,12 @@ env:
   value: linkerd-collector.{{.Values.global.namespace}}.svc.{{.Values.global.clusterDomain}}:55678
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_NAME
   value: linkerd-collector.{{.Values.global.namespace}}.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
-{{ else if .Values.global.proxy.trace -}}
-{{ if .Values.global.proxy.trace.collectorSvcAddr -}}
+{{ else if .Values.global.proxy.trace.collectorSvcAddr -}}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_ADDR
   value: {{ .Values.global.proxy.trace.collectorSvcAddr }}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_NAME
   value: {{ .Values.global.proxy.trace.collectorSvcAccount }}.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
 {{ end -}}
-{{ end -}}
 image: {{.Values.global.proxy.image.name}}:{{.Values.global.proxy.image.version}}
 imagePullPolicy: {{.Values.global.proxy.image.pullPolicy}}
 livenessProbe:
@@ -119,8 +121,12 @@ lifecycle:
         - -c
         - sleep {{.Values.global.proxy.waitBeforeExitSeconds}}
 {{- end }}
-{{- if or (not .Values.global.proxy.disableIdentity) (.Values.global.proxy.saMountPath) }}
+{{- if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing)  (not .Values.global.proxy.disableIdentity) (.Values.global.proxy.saMountPath) }}
 volumeMounts:
+{{- if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing) }}
+- mountPath: var/run/linkerd/podinfo
+  name: podinfo
+{{- end -}}
 {{- if not .Values.global.proxy.disableIdentity }}
 - mountPath: /var/run/linkerd/identity/end-entity
   name: linkerd-identity-end-entity

diff --git a/charts/partials/templates/_volumes.tpl b/charts/partials/templates/_volumes.tpl
@@ -3,3 +3,24 @@ emptyDir:
   medium: Memory
 name: linkerd-identity-end-entity
 {{- end -}}
+
+{{/*
+This volume is attached to the proxy when distributed tracing is enabled, thus allowing the proxy to attach pod's labels as span attributes.
+This is done to attach more context to traces in order to allow filtering based on workload type, name, namespace, etc.
+
+The above information already exists as pod labels except for namespace, which is fixed by adding a `linkerd.io/workload-ns` label.
+instead of using downwardAPI to attach `metadata.namespace` as ENV and making the proxy add the ENV as a span attribute,
+this way is chosen, to keep the proxy unaware of k8s namespace and only have a single way to add attributes to spans i.e
+through a file.
+
+For control-plane components, `linkerd.io/workload-ns` label is only added to `spec.template.metadata.labels` but not label-selectors
+as they are immutable and would fail upgrades.
+*/}}
+{{ define "partials.proxy.volumes.labels" -}}
+downwardAPI:
+  items:
+  - fieldRef:
+      fieldPath: metadata.labels
+    path: "labels"
+name: podinfo
+{{- end -}}
diff --git a/charts/patch/templates/patch.json b/charts/patch/templates/patch.json
@@ -66,6 +66,14 @@
     "value": []
   },
   {{- end }}
+  {{- if (.Values.global.proxy.trace.collectorSvcAddr) }}
+  {
+    "op": "add",
+    "path": "{{$prefix}}/spec/volumes/-",
+    "value":
+      {{- include "partials.proxy.volumes.labels" . | fromYaml | toPrettyJson | nindent 6 }}
+  },
+  {{- end }}
   {{- if not .Values.global.proxy.disableIdentity -}}
   {
     "op": "add",

diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
@@ -337,6 +337,17 @@ func TestUninjectAndInject(t *testing.T) {
 			injectProxy:      true,
 			testInjectConfig: proxyIgnorePortsConfig,
 		},
+		{
+			inputFileName:    "inject_emojivoto_deployment.input.yml",
+			goldenFileName:   "inject_emojivoto_deployment_trace.golden.yml",
+			reportFileName:   "inject_emojivoto_deployment_trace.report",
+			injectProxy:      true,
+			testInjectConfig: defaultConfig,
+			overrideAnnotations: map[string]string{
+				k8s.ProxyTraceCollectorSvcAddrAnnotation:    "linkerd-collector",
+				k8s.ProxyTraceCollectorSvcAccountAnnotation: "linkerd-collector.linkerd",
+			},
+		},
 	}
 
 	for i, tc := range testCases {

diff --git a/cli/cmd/install.go b/cli/cmd/install.go
@@ -789,7 +789,8 @@ func (options *installOptions) buildValuesWithoutIdentity(configs *pb.All) (*l5d
 				Request: options.proxyMemoryRequest,
 			},
 		},
-		UID: options.proxyUID,
+		UID:   options.proxyUID,
+		Trace: installValues.Global.Proxy.Trace,
 	}
 
 	installValues.Global.ProxyInit.Image.Name = registryOverride(options.initImage, options.dockerRegistry)

diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
@@ -75,6 +75,7 @@ func TestRender(t *testing.T) {
 			CliVersion:               "CliVersion",
 			ControllerComponentLabel: "ControllerComponentLabel",
 			ControllerNamespaceLabel: "ControllerNamespaceLabel",
+			WorkloadNamespaceLabel:   "WorkloadNamespaceLabel",
 			CreatedByAnnotation:      "CreatedByAnnotation",
 			ProxyInjectAnnotation:    "ProxyInjectAnnotation",
 			ProxyInjectDisabled:      "ProxyInjectDisabled",
@@ -96,7 +97,8 @@ func TestRender(t *testing.T) {
 					Inbound:  4143,
 					Outbound: 4140,
 				},
-				UID: 2102,
+				UID:   2102,
+				Trace: &charts.Trace{},
 			},
 			ProxyInit: &charts.ProxyInit{
 				Image: &charts.Image{

diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -16,6 +16,7 @@ spec:
         app: nginx
         linkerd.io/control-plane-ns: linkerd
         linkerd.io/proxy-deployment: nginx
+        linkerd.io/workload-ns: ""
     spec:
       containers:
       - image: nginx

diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -16,6 +16,7 @@ spec:
         app: redis
         linkerd.io/control-plane-ns: linkerd
         linkerd.io/proxy-deployment: redis
+        linkerd.io/workload-ns: ""
     spec:
       containers:
       - image: redis
@@ -164,6 +165,7 @@ spec:
         app: nginx
         linkerd.io/control-plane-ns: linkerd
         linkerd.io/proxy-deployment: nginx
+        linkerd.io/workload-ns: ""
     spec:
       containers:
       - image: nginx

diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -16,6 +16,7 @@ spec:
         app: redis
         linkerd.io/control-plane-ns: linkerd
         linkerd.io/proxy-deployment: redis
+        linkerd.io/workload-ns: ""
     spec:
       containers:
       - image: redis

diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
@@ -24,6 +24,7 @@ spec:
         app: contour
         linkerd.io/control-plane-ns: linkerd
         linkerd.io/proxy-deployment: contour
+        linkerd.io/workload-ns: heptio-contour
     spec:
       containers:
       - args: