How to update existing installation with external trust anchor cert?

[miguelvr]

hey team!

how do I upgrade an existing linkerd installation to use an external trust anchor secret?

the instructions here only mention an installation from scratch

[alpeb]

You can upgrade linkerd as instructed in the docs, making sure the identity.externalCA setting is enabled, and assuming the linkerd-identity-trust-roots ConfigMap is provisioned externally.
Note that if you're doing this through the CLI, the flag is --set identity.externalCA=true.
The dataplane pods will need to be restarted in order to pick the new trust root. The transition can cause downtime, but you can avoid that by bundling together the old and new cert, similarly as described here.