helm: identityTrustAnchorsPEM, identity.issuer.tls.crtPEM, identity.issuer.tls.keyPEM vs tap.caBundle, tap.crtPEM, tap.keyPEM vs tapInjector.caBundle, tapInjector.crtPEM, tapInjector.keyPEM

[jjangga0214]

Hi!

I am using linkerd-viz and linkerd-control-plane.

The former has tap.caBundle, tap.crtPEM, tap.keyPEM, tapInjector.caBundle, tapInjector.crtPEM, tapInjector.keyPEM values.

The latter has identityTrustAnchorsPEM, identity.issuer.tls.crtPEM, identity.issuer.tls.keyPEM values.

Can I set

tap.caBundle == tapInjector.caBundle == identityTrustAnchorsPEM

AND

tap.crtPEM == tapInjector.crtPEM == identity.issuer.tls.crtPEM

AND

tap.keyPEM == tapInjector.keyPEM == identity.issuer.tls.keyPEM

?

Is that possible and proper?

For example, if I write on helmfile's config, it'd be like the snippet below.
(helmfile runs helm internally. For example, set: in yaml is equal to --set-file in cli)

  - name: linkerd-viz
    set:
      - name: tap.caBundle
        file: values/prod/certs/linkerd.ca.crt
      - name: tap.crtPEM
        file: values/prod/certs/linkerd.tls.crt
      - name: tap.keyPEM
        file: values/prod/certs/linkerd.tls.key
      - name: tapInjector.caBundle
        file: values/prod/certs/linkerd.ca.crt
      - name: tapInjector.crtPEM
        file: values/prod/certs/linkerd.tls.crt
      - name: tapInjector.keyPEM
        file: values/prod/certs/linkerd.tls.key

  - name: linkerd-control-plane
    set:
      - name: identityTrustAnchorsPEM
        file: values/prod/certs/linkerd.ca.crt
      - name: identity.issuer.tls.crtPEM
        file: values/prod/certs/linkerd.tls.crt
      - name: identity.issuer.tls.keyPEM
        file: values/prod/certs/linkerd.tls.key

[jjangga0214]

@olix0r Sorry for the mention.
But may I ask the answer, please?
It's a very basic question, but nobody cares, even on StackOverflow...

[olix0r]

It's probably best to decouple the identity credentials from the other credentials -- if you're giving the issuer private key to all of the other workloads that substantially weakens the security of your mesh.

As for the webhook credentials, I don't think you can reuse certificates between webhooks, since each needs to be configured with its proper DNS name.