Linkerd OPA Blocks Proxy Injection

You encounter a linkerd configuration issue that prevents your workflow from completing. This guide walks through the fix step by step.

Wrong ❌

# OPA rule blocking all mutations
apiVersion: admission.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata: { name: deny-linkerd-injection }
spec:
  matchConstraints: { resourceRules: [{ apiGroups: [""], apiVersions: ["v1"], operations: ["CREATE"], resources: ["pods"] }] }
  validations:
    - expression: "!has(object.metadata.annotations) || !has(object.metadata.annotations['linkerd.io/inject'])"

Wrong Output

Pod creation fails. Admission webhook denied. Linkerd injection blocked.

Right ✅

apiVersion: admission.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata: { name: allow-linkerd-injection }
spec:
  matchConstraints: { resourceRules: [{ apiGroups: [""], apiVersions: ["v1"], operations: ["CREATE"], resources: ["pods"] }] }
  validations:
    - expression: "!has(object.metadata.annotations) || !has(object.metadata.annotations['linkerd.io/inject']) || object.metadata.namespace in ['default', 'production']"
      message: "Linkerd injection only in designated namespaces"

Right Output

Pod created with Linkerd injection. Sidecar injected. OPA allows in designated namespaces.

Prevention

• Create OPA policies that allow injection in designated namespaces.
• Use namespace allow-lists instead of blanket deny.
• Test OPA policies with dry-run before enforcing.
• Check OPA logs for admission decision details.
• Add injection namespaces to an allow-list.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with opa admission

1. Mixing let bindings with <- bindings in do notation, producing type errors
2. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors
3. Non-exhaustive pattern matches that compile with warnings then crash at runtime

These mistakes appear frequently in real-world LINKERD code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.