Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Annotate workloads for later Linkerd injection

linkerd-annotate is a local Kubernetes manifest transformer for Linkerd admission annotations.

Agent
Prepare a workload annotationKeep deployment separateInspect the native transform

overview

What linkerd-annotate does

Annotate local Kubernetes workloads for later Linkerd admission injection. No sidecar rendering, cluster access or deployment.

Run linkerd inject --ignore-cluster from upstream edge-26.9.3 against a staged local YAML/JSON file. The output adds linkerd.io/inject: enabled to supported workload pod templates. A separately configured admission injector must later add the proxy when the workload is admitted.

Accept 1 to 100 resource documents, at most 2 MiB, with safe YAML structure prechecks. Native transformation has a 60-second timeout and 20 MiB output limit. Kubeconfig and environment are isolated; images, URLs and manifest command fields are not executed or fetched. Existing outputs are refused and failures publish no output.

Packaged version: edge-26.9.3. Upstream license: Apache-2.0.

source github.com/linkerd/linkerd2/tree/86d395080040d07b8e0109547135520218b696f7

use cases

Where linkerd-annotate fits

Prepare a workload annotation

Mark a pod template for later admission-time injection.

Keep deployment separate

Receive YAML for review without querying or changing a cluster.

Inspect the native transform

Review the annotation while retaining the fixture app container and port.

reference

linkerd-annotate inputs and flags

1 inputs
NameTypeFlagDescription
inputFILE--inputLocal Kubernetes YAML/JSON resources up to 2 MiB and 100 documents; uses built-in edge release defaults, not live mesh configuration.

Showing key inputs. linkerd-annotate exposes 1 inputs in total.

example

Run linkerd-annotate

linkerd-annotate · command
python3 /app/run.py --input ./input.txt ./output

guidance

Choosing linkerd-annotate

Use linkerd-annotate to prepare an admission annotation, not to render or install proxy sidecars. Existing injections pass through native uninject/reinject logic, so hand-edited sidecars are not preserved byte for byte. Non-workload resources may pass through unchanged. This is an upstream edge release with built-in defaults, not live mesh configuration.

faq

linkerd-annotate questions

input: Local Kubernetes YAML/JSON resources up to 2 MiB and 100 documents; uses built-in edge release defaults, not live mesh configuration.

Run linkerd inject --ignore-cluster from upstream edge-26.9.3 against a staged local YAML/JSON file. The output adds linkerd.io/inject: enabled to supported workload pod templates. A separately configured admission injector must later add the proxy when the workload is admitted.

Accept 1 to 100 resource documents, at most 2 MiB, with safe YAML structure prechecks. Native transformation has a 60-second timeout and 20 MiB output limit. Kubeconfig and environment are isolated; images, URLs and manifest command fields are not executed or fetched. Existing outputs are refused and failures publish no output.

Use linkerd-annotate to prepare an admission annotation, not to render or install proxy sidecars. Existing injections pass through native uninject/reinject logic, so hand-edited sidecars are not preserved byte for byte. Non-workload resources may pass through unchanged. This is an upstream edge release with built-in defaults, not live mesh configuration.

The public image repository gives immutable image and ORAS download commands, the expected source/notices bundle checksum and pinned upstream source directions. The accompanying OCI bundle retains the original build recipe, runtime sources and full installed notices. The Git recipe keeps primary notices and an exact layer/hash index; it does not duplicate the full installed notice tree or mirror every upstream source archive. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run linkerd-annotate yourself

The saved verifier confirmed the enabled annotation on a Deployment, its original app image and port, and the absence of linkerd-proxy and linkerd-init containers. The complete transformed YAML was not retained. The command shows the container entrypoint with example paths.

Open linkerd-annotate in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.