---
title: "Announcing Linkerd 2.19: Post-quantum cryptography"
url: https://daily.dev/posts/announcing-linkerd-2-19-post-quantum-cryptography-5blebeq0f
source_url: https://linkerd.io/2025/10/31/announcing-linkerd-2.19
type: article
source: "Linkerd"
published: 2026-08-23T12:23:30.379Z
updated: 2026-08-23T12:55:53.896Z
tags: ["kubernetes", "infrastructure", "quantum-computing", "service-mesh"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Announcing Linkerd 2.19: Post-quantum cryptography

**[Linkerd](https://daily.dev/sources/linkerd)** · 3 min read · 0 upvotes · 0 comments

## Summary

Linkerd 2.19 ships a modernized TLS stack that uses post-quantum key exchange by default, switching the proxy's cryptographic module from ring to aws-lc and adding AES_256_GCM ciphersuite plus ML-KEM-768 key exchange for all meshed pod communication. TLS cipher, key exchange, and signature algorithms are now exposed as metrics. The release also promotes native sidecar support from alpha to beta (enabled via the config.beta.linkerd.io/proxy-enable-native-sidecar annotation) and fixes several smaller bugs, including blocking connections to undefined clusterIP Service ports, discovery staleness in native-sidecar mode, a control-plane panic on invalid hostnames, and an issue with invalid podSelectors breaking Server resource processing.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://linkerd.io/2025/10/31/announcing-linkerd-2.19>

## Questions this post answers

### What changed in Linkerd 2.19's TLS implementation for post-quantum security?

Linkerd 2.19 switches its proxy's core cryptographic module from ring to aws-lc and enables the AES_256_GCM ciphersuite along with the post-quantum ML-KEM-768 key exchange algorithm by default for all communication between meshed pods. TLS cipher, key exchange, and signature algorithm details are also now exported as standard metrics for visibility.

_Track service mesh security upgrades like this one on daily.dev before rolling changes into production._

### How do I enable native sidecars in Linkerd 2.19?

Native sidecar support is promoted from alpha to beta in Linkerd 2.19 and can be enabled by setting the config.beta.linkerd.io/proxy-enable-native-sidecar annotation. Native sidecars were first supported in Linkerd 2.15 and rely on the Kubernetes native sidecar containers feature, which graduated to stable in Kubernetes as of April. This addresses long-standing sidecar issues with Jobs and container startup race conditions.

_Developers weighing Kubernetes sidecar strategies can follow feature maturity updates like this on daily.dev._

## Similar posts on daily.dev

- [Linkerd 2.20, the Latest Release of the Cloud-Native Service Mesh, Arrives](https://daily.dev/posts/linkerd-2-20-the-latest-release-of-the-cloud-native-service-mesh-arrives-ketitd8if) · Cloud Native Now · 0 upvotes · 0 comments

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#service-mesh](https://daily.dev/tags/service-mesh)

[View this post on daily.dev](https://daily.dev/posts/announcing-linkerd-2-19-post-quantum-cryptography-5blebeq0f)