# Install Linkerd

> [HTML Version](install-linkerd.html)

Linkerd is a dedicated infrastructure layer that facilitates service-to-service communication, automatically encrypts connections, handles retries and timeouts. Installing the Linkerd add-on component ensures balancing of gRPC traffic when scaling BRIX services. It also provides telemetry (success rates, latencies), and much more.

Linkerd is a necessary component for enabling support of service scaling on the side of the BRIX application. Without Linkerd installed, scaling of BRIX microservices will not work.

To learn about installing Linkerd using Cert-manager, see [Install Linkerd using Cert-manager](linkerd-with-cert-manager.md).

This article covers how to:

- Prepare certificates using openssl for Linkerd and install it.

- [Delete the Linkerd chart using Helm in the Kubernetes cluster](#delete_chart).

The installation consists of four steps:

1. [Prepare certificates for Linkerd](#preparation-of-certificates).

2. [Download the Helm chart and configuration file](#download-helm-chart-and-config-file).

3. [Fill out the configuration file](#fill-config-file).

4. [Install the Linkerd chart using helm in the Kubernetes cluster](#install-linkerd-chart).

## Step 1: Prepare certificates for Linkerd

Generate certificates using OpenSSL with the commands below. Linkerd requires a trust anchor certificate and issuer certificates with the corresponding key to support mutual TLS connections between services. All certificates must use the **ECDSA P-256** algorithm.

````
\# Create CA private key  
openssl ecparam -name prime256v1 -genkey -noout -out ca-private.pem  
\# Create CA public key  
openssl ec -in ca-private.pem -pubout -out ca-public.pem  
\# Create self-signed CA certificate  
openssl req -x509 -new -key ca-private.pem -days 3650 -out ca.crt -subj "/CN=root.linkerd.cluster.local"  
\# Create issuer private key  
openssl ecparam -name prime256v1 -genkey -noout -out issuer-private.pem  
\# Create issuer public key  
openssl ec -in issuer-private.pem -pubout -out issuer-public.pem  
\# Create certificate signing request  
openssl req -new -key issuer-private.pem -out issuer.csr -subj "/CN=identity.linkerd.cluster.local" -addext basicConstraints=critical,CA:TRUE  
\# Create issuer certificate by signing the request  
openssl x509 \\  
\-extfile /etc/ssl/openssl.cnf \\  
\-extensions v3\_ca \\  
\-req \\  
\-in issuer.csr \\  
\-days 3650 \\  
\-CA ca.crt \\  
\-CAkey ca-private.pem \\  
\-CAcreateserial \\  
\-extensions v3\_ca \\  
\-out issuer.crt  
\# Remove certificate signing request  
rm issuer.csr

## ````
Step 2: Download the Helm chart and configuration file

To install via the internet, obtain the \[OBJECT\] configuration file by executing the command:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm show values brix365/linkerd > values-linkerd.yaml

````
Obtaining the configuration file for a closed-loop installation with no internet access

1. On a computer with internet access, download the BRIX images and upload them to your local image registry by executing the following command:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm pull brix365/linkerd

````
For more details, see [Download BRIX images](downloadin-images-elma365.md).

2. Copy the downloaded \[OBJECT\] chart archive to the server where the installation will be performed.

3. Unpack this chart and copy the default configuration file \[OBJECT\] to \[OBJECT\]:

````
tar -xf linkerd-X.Y.Z.tgz  
cp linkerd/values.yaml values-linkerd.yaml
````

## ````
Step 3: Fill out the configuration file

Fill out the \[OBJECT\] configuration file for installing Linkerd:

1. Specify the DNS domain name of the Kubernetes cluster in the \[OBJECT\] parameter, in this case, \[OBJECT\].

````
\# Linkerd settings  
linkerd:  
  # DNS domain name of Kubernetes  
  clusterDomain: cluster.local  
  # dds PodSecurityPolicy resource (deprecated starting with k8s v1.21)  
  enablePSP: false  
  # disable heartbeat  
  disableHeartBeat: false    
...

2. ````
To ensure high availability, you may uncomment the parameters in the **Parameters for high availability** section.

Example of enabling high availability

````
  
\# Linkerd settings  
linkerd:  
...  
\#  
\# Perameters for high availability  
  controllerReplicas: 3  
  enablePodDisruptionBudget: true  
  deploymentStrategy:  
    rollingUpdate:  
      maxUnavailable: 1  
      maxSurge: 25%  
  enablePodAntiAffinity: true  
  proxy:  
    resources:  
      cpu:  
        request: 100m  
      memory:  
        limit: 250Mi  
        request: 20Mi  
  controllerResources: \&controller\_resources  
    cpu: \&controller\_resources\_cpu  
      limit: ""  
      request: 100m  
    memory:  
      limit: 250Mi  
      request: 50Mi  
  destinationResources: \*controller\_resources  
  identityResources:  
    cpu: \*controller\_resources\_cpu  
    memory:  
      limit: 250Mi  
      request: 10Mi  
  heartbeatResources: \*controller\_resources  
  proxyInjectorResources: \*controller\_resources  
  webhookFailurePolicy: Fail  
  spValidatorResources: \*controller\_resources  
\#   
...
````

3. ````
If you have installed [monitoring tools](install-monitoring-tools.md), specify the parameter for Linkerd metrics:

````
\# Connection parameter for metrics collection  
podMonitor:  
  enabled: true

4. ````
If you install Linkerd in a isolated environment without internet access, fill out the connection parameters for the private **registry**.

How to fill out connection parameters for the private registry

1. Download the BRIX images and upload them to the local image registry. For more details, see [Download BRIX images](downloadin-images-elma365.md).

2. Specify address and path in parameters \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\].

3. Specify the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be manually created and encrypted in Base64.

````
\# linkerd settings  
linkerd:  
...  
  # connection parameters to the private registry  
  # address and path for the private registry  
  controllerImage: registry.example.com/linkerd/controller  
  policyController:  
    image:  
      # address and path for the private registry  
      name: registry.example.com/linkerd/policy-controller  
  proxy:  
    image:  
      # address and path for the private registry  
      name: registry.example.com/linkerd/proxy  
  proxyInit:  
    image:  
      # address and path for the private registry  
      name: registry.example.com/linkerd/proxy-init  
  # secret with access rights to the private registry must be created manually, encrypted in Base64  
  imagePullSecrets:  
    - name: myRegistryKeySecretName

````
Where the format is as follows:

- \[OBJECT\]:

	- Address is \[OBJECT\].

	- Path is \[OBJECT\].

- \[OBJECT\]:

	- Address is \[OBJECT\].

	- Path is \[OBJECT\].

- \[OBJECT\]:

	- Address is  \[OBJECT\].

	- Path is \[OBJECT\].

- \[OBJECT\]:

	- Address is  \[OBJECT\].

	- Path is \[OBJECT\].

## Step 4: Install the Linkerd chart using helm in the Kubernetes cluster

Perform the installation of the Linkerd chart in \[OBJECT\]. The namespace will be created during installation if it was not previously created.

Within the article, the installation command is executed from the directory where the certificates were created in Step 1. If the command is being executed from a different directory, specify the paths to the certificates created in Step 1 (\[OBJECT\], \[OBJECT\], \[OBJECT\]). 

For online installation:

````
helm upgrade --install linkerd brix365/linkerd -f values-linkerd.yaml -n linkerd --create-namespace \\  
\--set-file linkerd.identityTrustAnchorsPEM=ca.crt \\  
\--set-file linkerd.identity.issuer.tls.crtPEM=issuer.crt \\  
\--set-file linkerd.identity.issuer.tls.keyPEM=issuer-private.pem

````
For offline installation:

````
helm upgrade --install linkerd ./linkerd -f values-linkerd.yaml -n linkerd --create-namespace \\  
\--set-file linkerd.identityTrustAnchorsPEM=ca.crt \\  
\--set-file linkerd.identity.issuer.tls.crtPEM=issuer.crt \\  
\--set-file linkerd.identity.issuer.tls.keyPEM=issuer-private.pem

Начало внимание

````
After installing Linkerd, change the BRIX application settings and set up autoscaling of services. Read more in the [Enable service autoscaling in BRIX On-Premises](autoscaling-service-enterprise.md) article.

````
Конец внимание

## ````
Delete Linkerd chart using helm in a Kubernetes cluster

````
Начало внимание

````
Before removing the Linkerd add-on component, disable auto-scaling on the side of the BRIX application.

````
Конец внимание

````
To delete the Linkerd chart in \[OBJECT\], run the following command:

````
helm uninstall linkerd -n linkerd
````