---
title: "Linkerd Edge Release Roundup: September 2025"
url: https://daily.dev/posts/linkerd-edge-release-roundup-september-2025-vnet5ry5w
source_url: https://linkerd.io/2025/09/05/linkerd-edge-release-roundup
type: article
source: "Linkerd"
published: 2026-08-23T12:23:30.697Z
updated: 2026-08-23T12:56:07.484Z
tags: ["kubernetes", "infrastructure", "quantum-computing", "service-mesh"]
reading_time: 4
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Linkerd Edge Release Roundup: September 2025

**[Linkerd](https://daily.dev/sources/linkerd)** · 4 min read · 0 upvotes · 0 comments

## Summary

Recap of Linkerd's August 2025 edge releases (edge-25.8.1 through edge-25.8.5), all recommended for production use. Highlights include a fix for native-sidecar proxies landing in an error state, merging the policy-controller image into the main controller image (deprecating the policyController.image Helm value), switching the default iptables routing command from iptables-legacy to iptables-nft, dropping ARMv7 support, and the proxy defaulting to the post-quantum key exchange algorithm X25519MLKEM768.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://linkerd.io/2025/09/05/linkerd-edge-release-roundup>

## Questions this post answers

### Why did my Linkerd native-sidecar proxies end up in an error state after the main container exited?

This was a bug introduced in edge-25.6.3 where native-sidecar proxies would land in an error state after the main container exited, tracked as issue #14289. It was fixed in edge-25.8.1, so anyone running edge-25.6.3 or later with native sidecars should upgrade to edge-25.8.1 or newer to resolve it.

_daily.dev helps engineers running linkerd service mesh track fixes like this before they hit production._

### Does Linkerd still ship a separate policy-controller image?

No, as of edge-25.8.3 the policy controller is bundled into the main Linkerd controller image, and the separate policy-controller image is no longer shipped. This means the policyController.image Helm value is now ignored, reducing image pull traffic for Linkerd deployments.

_Track breaking Helm value changes like this on daily.dev before upgrading your service mesh._

### Why did Linkerd switch from iptables-legacy to iptables-nft by default?

Linkerd switched the default command for programming routing tables from iptables-legacy to iptables-nft starting in edge-25.8.2. Nodes that do not support iptables-nft can revert by setting proxyInit.iptablesMode to legacy in the linkerd2-control-plane chart, or iptablesMode to legacy in the linkerd2-cni chart.

_daily.dev keeps infrastructure teams current on networking defaults like linkerd's iptables switch._

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#service-mesh](https://daily.dev/tags/service-mesh)

[View this post on daily.dev](https://daily.dev/posts/linkerd-edge-release-roundup-september-2025-vnet5ry5w)