Linkerd-Viz Tap FailedDiscoveryCheck while Running on EKS

I wanted to post some information here in case someone runs into this issue with Linkerd in the future and are running on EKS. Specifically those running the Terraform EKS Module.

ā€¼ tap API service is running
    FailedDiscoveryCheck: failing or missing response from https://100.64.57.235:8089/apis/tap.linkerd.io/v1alpha1: Get "https://100.64.57.235:8089/apis/tap.linkerd.io/v1alpha1": dial tcp 100.64.57.235:8089: i/o timeout
    see https://linkerd.io/2.13/checks/#l5d-tap-api for hints

Also, when viewing the linkerd viz dashboard you will see 503 errors that relate to this issue.
The way to fix this issue is to allow port 8088-8089 inbound from the EKS Cluster Security group, to the security group running on the nodes.
To be clear - create a rule on the inbound security group rule list on the nodes, with a source of the EKS Cluster Security Group.

You may have to restart the linkerd-viz tap component, but shortly after tap will be running and you will be able to see your traffic.

2 Likes

Thank you @yourbromike!