[linkerd-viz dashboard] live calls results in "certificate signed by unknown"

[uqix]

Installed by helm(fluxcd):

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: linkerd-viz
spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: linkerd
      chart: linkerd-viz
      version: 2.11.4
  values:
    # create manually to put HelmRepository and HelmRelease
    installNamespace: false
    nodeSelector: &nodeSelector
      op-load: "true"
    metricsAPI:
      nodeSelector: *nodeSelector
    grafana:
      nodeSelector: *nodeSelector
    prometheus:
      nodeSelector: *nodeSelector

Any page with live calls results in error:

Websocket close error [1011: Internal Error] : HTTP error, status Code [503] (unexpected API response: error trying to reach service: x509: certificate signed by unknown

and logs in tap pod:

2022/07/31 11:53:07 http: TLS handshake error from 10.244.24.221:37026: remote error: tls: bad certificate

BTW, is it ok to leave out helm values tap.crtPEM/keyPEM/caBundle?

[Sierra1011]

By design the Helm chart doesn't bootstrap a certificate for either control-plane or viz. You'll either need to make a certificate manually and add the encoded data, or use cert-manager to create a certificate chain.
More information on TLS certs for the control-plane here, viz here.