linkerd inject: Add Proxies to Manifests
linkerd inject rewrites Kubernetes manifests to add the Linkerd proxy-injection annotation (or, with --manual, the full sidecar).
Piping manifests through linkerd inject before apply is the standard way to mesh a workload from CI, and it is easy to diff so reviewers see exactly what changed.
What it does
linkerd inject reads Kubernetes YAML and adds the linkerd.io/inject: enabled annotation to pod templates so the proxy-injector webhook adds the sidecar at admission. With --manual it injects the full proxy container directly instead of relying on the webhook.
Common usage
linkerd inject deployment.yaml | kubectl apply -f -
# inject a whole directory
cat ./k8s/*.yaml | linkerd inject - | kubectl apply -f -
# re-inject after a proxy upgrade
kubectl get deploy my-app -o yaml | linkerd inject - | kubectl apply -f -Options
| Flag | What it does |
|---|---|
| --manual | Inject the sidecar directly instead of the annotation |
| --enable-debug-sidecar | Add the debug container for troubleshooting |
| --ignore-inbound-ports <p> | Ports the proxy should not intercept inbound |
| --ignore-outbound-ports <p> | Ports to skip on outbound |
| -o yaml | Print the injected manifest (the default) |
In CI
Run linkerd inject in the deploy stage and pipe straight to kubectl apply. Verify the result with linkerd check --proxy afterward. Re-run inject when you upgrade Linkerd so proxies pick up the new version.
Common errors in CI
"Error: could not inject ... no supported resources found" means the input had no Deployment/Pod/StatefulSet to inject. A resource that reports "injection skipped" already has the annotation or is a kind inject leaves alone. If the sidecar never appears after apply, the proxy-injector webhook is down, which linkerd check surfaces.