micke-post

Alright, got it. Thanks for the information!

> I'll also point out that Linkerd's TLS handling has changed significantly between edge-25.2.1 (where you reported the issue) and now (e.g. edge-25.6.4). I would recommend upgrading to a more...

Unfortunately the issue occurred despite the upgrade to 25.6.2. This time we were lucky enough to be able to get a look at the in-progress issue and could gather some...

The inbound side blocks incoming requests since they don't use tls, but we suspect that the issue might start on the client side, either due to a failed handshake or...

Awesome, happy to hear that the reproduction scenario is not specific to just our environment. I'll see if we can set up some monitoring to correlate the issue with the...

Yeah, I haven't figured out how to reproduce that yet. When the issue occurs in prod we see that subsequent calls from the same route keep failing, similar to how...

[Here you go](https://gist.github.com/micke-post/72fd10d4a30f9c0a5c409657f9fd23a7). That gist contains debug logs of both prometheus and one of the clients it was unable to scrape (linkerd-403-looper-client-777bfd6f7b-zwffq/10.207.204.65).

I also tried it with my reproduction helm chart, and after setting the `config.alpha.linkerd.io/proxy-enable-native-sidecar: "false"` annotation on the namespace prometheus was able to scrape all endpoints without further issues. Thanks...