Linkerd Helm chart installation certificate issue

[shahriak]

Greetings Linkerd Community,

We are trying to install Linkerd using Helm. We have an automated process which simply pulls the Helm chart and deploys it onto an AKS cluster. The only hurdle is that the Helm command requires root and issuer certs to be passed. I would like to reduce the command from 1 to 2

I have already looked into cert-manager but it seems rather complicated. Could you guys please provide some input?

Is it possible to update the certs after linkerd installation using Helm and restart the pods to pick up the certs?

	helm install linkerd2 \
	  --set-file global.identityTrustAnchorsPEM=ca.crt \
	  --set-file identity.issuer.tls.crtPEM=issuer.crt \
	  --set-file identity.issuer.tls.keyPEM=issuer.key \
	  --set identity.issuer.crtExpiry=$exp \
	  linkerd/linkerd2

helm install linkerd2 linkerd/linkerd2

[grampelberg]

This is an unfortunate limitation of helm. We can generate certificates with helm, but not persist them between upgrades. If you want a single command I would recommend using linkerd install.

[shahriak]

There is a way to bypass this limitation. I was able to include some dummy values for the 4 parameters and it was able to install all the components but the pods are in "CrashLoopBackOff" state which makes sense since the certs are invalid. How do we go about updating the certs once Linkerd has been installed?

[grampelberg]

What problem are you trying to solve to begin with? I'm super confused.

[shahriak]

Apologies for not being too clear. What I am trying to do is basically update the root and issuer cert once linkerd has been deployed in the cluster and restart all pods to use the latest certs and bring the pods to a "Running" state. Does that make sense?

[grampelberg]

I guess I don't understand why you want to update them after the install?

[shahriak]

The problem is during helm installation, I cannot pass the arguments "--set file" to pass the certificates (it is owned by another team and is not our control). The only way I am able to bypass this is update the chart with some dummy certs and then after installation is complete, update the root, issuer and key with proper certs.

[grampelberg]

Why can't you pass --set?

[feiyushi]

@shahriak Do you have a solution now? I'm interested to know how to helm upgrade with new certs with no down time. thx