Add an option (policy) to enforce mTLS for outbound traffic

What problem are you trying to solve?

A meshed client will send plaintext traffic when a Kubernetes Service points to a non-meshed pod. For example, a Service initially points to a meshed server. If its selector or endpoints are changed to point to a non-meshed pod, the client’s Linkerd proxy receives no destination identity and connects without mTLS. Inbound authorization does not protect against this because the traffic no longer reaches the original server. I need a way for clients to require mTLS and fail closed when the destination is not meshed.

How should the problem be solved?

Add an outbound policy that requires mTLS for selected Services or workloads. When enabled, the outbound proxy should reject the connection if:

• The destination has no Linkerd identity.
• mTLS cannot be established. Linkerd should never fall back to plaintext when this policy applies.

Any alternatives you've considered?

Inbound authorization can require authenticated traffic at the server, but it does not protect the client if a Service is redirected to another backend. Kubernetes NetworkPolicy can restrict network access, but it cannot verify a Linkerd destination identity or guarantee that traffic uses Linkerd mTLS.

How would users interact with this feature?

A simple namespace or workload annotation could require mTLS:

metadata:
  annotations:
    config.linkerd.io/default-outbound-policy: all-authenticated

Or A set of CRDs that specify fine-grained policy for specific ports, routes, workloads, etc.

Would you like to work on this feature?

maybe