ncreases the access timeout linkerd+haproxy ingress

[alexkayzer]

What is the issue?

When adding a service mesh to Ingress HaProxy, CPU consumption increases and the access timeout to Ingress increases.

and without linkerd

and response time ( in 11-00 we are injecting linkerd until to 12-10)

How can it be reproduced?

annotations:
linkerd.io/inject: ingress
on haproxy

Logs, error output, etc

no errors

output of linkerd check -o short

----------------
× trust anchors are using supported crypto algorithm
    Invalid trustAnchors:
        * 46870470337585373751820917363133337951824404394 Root-CA must use P-256 curve for public key, instead P-384 was used
    see https://linkerd.io/2.14/checks/#l5d-identity-trustAnchors-use-supported-crypto for hints

linkerd-viz
-----------
‼ linkerd-viz pods are injected
    could not find proxy container for metrics-api-76c5469458-pvsqd pod
    see https://linkerd.io/2.14/checks/#l5d-viz-pods-injection for hints
‼ viz extension pods are running
    pod "metrics-api-76c5469458-pvsqd" status is Running
    see https://linkerd.io/2.14/checks/#l5d-viz-pods-running for hints
‼ viz extension proxies are healthy
    pod "metrics-api-76c5469458-pvsqd" status is Running
    see https://linkerd.io/2.14/checks/#l5d-viz-proxy-healthy for hints

Environment

k8s- 1.32.5
haproxy-ingress 3.10
linkerd -edge2025.11.1

Possible solution

No response

Additional context

No response

Would you like to work on fixing this bug?

None

[adleong]

Hi @alexkayzer

Linkerd's CPU consumption depends a lot on the volume and nature of the traffic it's processing as well as how it's configured. Here are some data points that would be helpful in determining if the CPU usage you're seeing is unexpected:

• What request volume (request per second) is Linkerd handling here?
• What protocols? HTTP? TLS? gRPC? TCP?
• What is the typical request size in bytes?
• What are the nature of the requests? unary? streaming? long-polling?
• What resource limits and requests have you configured for the Linkerd proxy?

[alexkayzer]

Hello, adleong!

• 22.5k rps (180k rps on 8 ingress-controllers)
• We use only http v1.1 prot
• diff size from 3kb to 109kb,
• unary
• resource limit 48 cpu /24Gb mem on linkerd and 24cpu/48gb mem on haproxy containers