Linkerd Upgrade Flags: Cert Manager External Issuer

[davi5e]

Hello,

Simple question, I installed Linkerd2 using the CLI and --identity-external-issuer following the documentation to use cert-manager.

Reading the upgrade guide, there is neither mention to the issuer nor an option in linkerd upgrade to instruct Linkerd2 on it.

So my question is: the lack of --identity-external-issuer means the upgrade process don't touch this configuration?

If so, it's a little mystery as is, shouldn't this fact be clearer in the documentation? It's a bad implicit assumption, IMHO...

[alpeb]

Hi @davi5e,

Any configuration used during installation will be persisted in the linkerd-config ConfigMap and will get reused during upgrades. The issuer config is just one of the many config options available. As the upgrade docs state:

Use the linkerd upgrade command to upgrade the control plane. This command ensures that all of the control plane’s existing configuration and mTLS secrets are retained.

Can you please clarify what happened in your case?

[davi5e]

So, we are experiencing an error in Linkerd2 that I personally thought was due to GKE's VM image (either 1.18.17-gke.1900 or 1.18.18-gke.1100). I'll open a bug report since our internal tests aren't getting anywhere — not the point of this topic.

The question per se happened because we use Terraform to install Linkerd2 and are pretty sure the installation had the option --identity-external-issuer. We could always see linkerd check issuing the "error" below:

‼ issuer cert is valid for at least 60 days
    issuer certificate will expire on 2021-06-01T18:13:19Z
    see https://linkerd.io/2.10/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints

But during our debugging of Linkerd we noticed this message was gone, as if Linkerd somehow started using another way to handle mTLS.

As we had the same installation since Linkerd 2.8.0 and 12 months had not passed to see the TLS expiration, we have no idea how this configuration would have changed...