Deploy Linkerd control plane with mTLS and configure a ServiceProfile for per-route success rate metrics and retries

Steps

1. Install the Linkerd CLI: curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh and run linkerd check --pre to validate cluster prerequisites
2. Generate CA and issuer certificates with step or the Linkerd cert generation guide, then install the control plane with those certs: linkerd install --identity-trust-anchors-file ca.crt --identity-issuer-certificate-file issuer.crt --identity-issuer-key-file issuer.key | kubectl apply -f -
3. Inject the data plane into namespaces by adding the annotation linkerd.io/inject: enabled to the namespace or using linkerd inject: kubectl get deploy -n myapp -o yaml | linkerd inject - | kubectl apply -f -
4. Create a ServiceProfile for the target service specifying routes with name, condition (pathRegex or method), and optionally retryBudget and timeout per route
5. Apply the ServiceProfile: kubectl apply -f serviceprofile.yaml and observe per-route golden metrics in the Linkerd dashboard: linkerd viz dashboard
6. Verify mTLS is active for pod-to-pod traffic: linkerd viz edges deployment -n myapp — the SECURED column should show a lock icon for meshed connections