Documentation / steps for updating tap cert after replacing root / issuer certs?

[whickman]

Hi linkerd folks,

After following the directions for replacing root + issuer certs here, linkerd check (linkerd v2.13.3) results in the following:

...
× tap API server has valid cert
    anchors not within their validity period:
        * <NUMBER/ID> tap.linkerd-viz.svc not valid anymore. Expired on <DATE>
    see https://linkerd.io/2.13/checks/#l5d-tap-cert-valid for hints
...

That link doesn't have instructions for updating the certs, and I was also surprised to see that following the root + issuer directions above didn't update the tap cert as well (double checked this by dry-running the upgrade command again and inspecting the output, which didn't modify any of the tap secrets / resources).

Did I miss something in the upgrade or am I missing docs / steps somewhere?

From the link in the error, I'd guess I need to follow these instructions for tap.linkerd-viz.svc rather than identity.linkerd.cluster.local (presumably using the newly-update root cert) and update the tap-k8s-tls secret with those values manually, but wanted to double-check.

Also, if those are the recommended steps, adding a sentence or two to the docs would be helpful (happy to open the PR myself if folks confirm those are the steps).

Thanks!

[hawkw]

I believe the answers you're looking for are in the docs on manually rotating webhook credentials. If you can think of anything we can change to make these docs clearer or easier to find, we'd definitely love a PR to the Linkerd website repo!

[whickman]

thank you @hawkw ! I've opened a PR to the website here: linkerd/website#1654