What are the key/value pairs of the linkerd-identity-trust-roots ConfigMap?

[cer]

I haven't seen a description anywhere in the docs.

[alpeb]

In a few words, the ca-bundle.crt key in the linkerd-identity-trust-roots ConfigMap holds a root certificate that sits at the base of the mechanism for providing mTLS across the data plane in the cluster. There's also an intermediate cert rooted on it, used for automatically providing leaf certs to all proxies. Proxies use those leafs to identify themselves, and they validate identities from other proxies by checking against the root cert.
If you install linkerd via the CLI, the root cert is created automatically. If installing via Helm you have to provide it yourself. You can find more details here: https://linkerd.io/2.13/tasks/generate-certificates/

And for more detailed information about mTLS in linkerd you can check these resources:
https://linkerd.io/2023/01/30/mtls-and-linkerd/
https://linkerd.io/2.13/features/automatic-mtls/

[cer]

Thanks for your reply.

The docs for setting up the certs was helpful even though I wish a Helm-based install could automatically configure the certs.

One key question: where is the name of the key ca-bundle.crt documented? That detail was not clear.

[alpeb]

That's just a name, used by the system to retrieve that cert; people usually don't have to interact with it. Can you explain why you're interested in that piece? Perhaps that context would allow me to provide a better answer.

[cer]

• I am installing Linkerd using Helm.
• I needed to create, the linkerd-identity-trust-roots ConfigMap
• In order to do that, I need to know the name of the key.
• I could not find a place in the documentation specified the key name

[alpeb]

In the docs I pointed above you'll see the instructions to generate the certs and how to pass them when installing via Helm:

helm install linkerd-crds linkerd/linkerd-crds \
  -n linkerd --create-namespace
helm install linkerd-control-plane -n linkerd \
  --set-file identityTrustAnchorsPEM=ca.crt \
  --set-file identity.issuer.tls.crtPEM=issuer.crt \
  --set-file identity.issuer.tls.keyPEM=issuer.key \
  linkerd/linkerd-control-plane

This will automatically persist the linkerd-identity-trust-roots ConfigMap:

$ kubectl -n linkerd get configmaps linkerd-identity-trust-roots -oyaml
apiVersion: v1
data:
  ca-bundle.crt: |-
    -----BEGIN CERTIFICATE-----
    MIIBjjCCATOgAwIBAgIQaAX9x/lJg9hhlXIZeYBTPjAKBggqhkjOPQQDAjAlMSMw
    IQYDVQQDExpyb290LmxpbmtlcmQuY2x1c3Rlci5sb2NhbDAeFw0yMzA1MjMxNDE1
    MjZaFw0zMzA1MjAxNDE1MjZaMCUxIzAhBgNVBAMTGnJvb3QubGlua2VyZC5jbHVz
    dGVyLmxvY2FsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiILvlmZfw2HvTNZS
    IPeE6dHj9LugPNjU2Kgtp5Mt4hKbEAhh37oGwLqSz0WJaABj4u2GUrEk3pJEciTz
    MpNpvqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
    VR0OBBYEFBSmJqX3p3GFGLeRApNMJpaLtBsuMAoGCCqGSM49BAMCA0kAMEYCIQCe
    fldtEwgthH+xowUf4aR1btAUN2IFHmNnyIAK0/kTCAIhAPP1ehtrqEkf1uxA62vA
    KOam47JALxECQRMCyLU95FZw
    -----END CERTIFICATE-----
kind: ConfigMap
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm stable-2.13.3
    meta.helm.sh/release-name: linkerd-control-plane
    meta.helm.sh/release-namespace: linkerd
  creationTimestamp: "2023-05-23T14:17:09Z"
  labels:
    app.kubernetes.io/managed-by: Helm
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
  name: linkerd-identity-trust-roots
  namespace: linkerd
  resourceVersion: "827"
  uid: 82836dc4-95ab-4437-96f2-8469e346cf6f

If you want you can provide this ConfigMap separately, as long as you pass the flag --set identity.externalCA=true to avoid helm install overwriting it.

[cer]

My question is simpler than this: where in the docs does it state that the linkerd-identity-trust-roots ConfigMap key is called ca-bundle.crt?

[alpeb]

It's just a variable name, an implementation detail, not usually exposed to users, unless you provide your own ConfigMap in which case people just look at the template in the Helm chart on which to base their own, so it's not documented explicitly.

[cer]

Why not document it since 'not usually' != 'never'?!

For my application, I'm deploying Linkerd using https://fluxcd.io/flux/guides/helmreleases/ so I can't run helm install --set-file
I suppose I could write a script that edit's the FluxCD HelmRelease to insert the certificate value.
But, currently I'm generating the ConfigMap and Secret (actually a SealedSecret) and putting them in Git.

But to be honest, I wish Linkerd would simply generate some sensible defaults so I could defer worrying about certs.

[omidraha]

I had same issue because I named it ca.crt as mentioned in docs .
It's better to mention this ca-bundle.crt name in this section of doc.

29s   Warning   Failed   pod/linkerd-proxy-injector-69ddcd4f45-tx9lw    
Error: couldn't find key ca-bundle.crt in ConfigMap linkerd/linkerd-identity-trust-roots