Recap of Linkerd's August 2025 edge releases (edge-25.8.1 through edge-25.8.5), all recommended for production use. Highlights include a fix for native-sidecar proxies landing in an error state, merging the policy-controller image into the main controller image (deprecating the policyController.image Helm value), switching the default iptables routing command from iptables-legacy to iptables-nft, dropping ARMv7 support, and the proxy defaulting to the post-quantum key exchange algorithm X25519MLKEM768.
Table of contents
How to give feedbackRecommendations and breaking changesThe releasesInstalling the latest edge releaseLinkerd is for everyoneQuestions this post answers
Why did my Linkerd native-sidecar proxies end up in an error state after the main container exited?
This was a bug introduced in edge-25.6.3 where native-sidecar proxies would land in an error state after the main container exited, tracked as issue #14289. It was fixed in edge-25.8.1, so anyone running edge-25.6.3 or later with native sidecars should upgrade to edge-25.8.1 or newer to resolve it. daily.dev helps engineers running linkerd service mesh track fixes like this before they hit production.
Does Linkerd still ship a separate policy-controller image?
No, as of edge-25.8.3 the policy controller is bundled into the main Linkerd controller image, and the separate policy-controller image is no longer shipped. This means the policyController.image Helm value is now ignored, reducing image pull traffic for Linkerd deployments. Track breaking Helm value changes like this on daily.dev before upgrading your service mesh.
Why did Linkerd switch from iptables-legacy to iptables-nft by default?
Linkerd switched the default command for programming routing tables from iptables-legacy to iptables-nft starting in edge-25.8.2. Nodes that do not support iptables-nft can revert by setting proxyInit.iptablesMode to legacy in the linkerd2-control-plane chart, or iptablesMode to legacy in the linkerd2-cni chart. daily.dev keeps infrastructure teams current on networking defaults like linkerd's iptables switch.