These instructions assume you have a running cluster with cert-manager already installed.

1. Create the Root CA and Identity Issuers and Certificates:

kubectl apply -f ./certs.yaml

2. Grab the generated Root CA certificate from the linkerd/root-secret secret.

3. Add it into the linkerd chart values and the ConfigMap

4. Create the trust bundle ConfigMap

kubectl apply -f ./cm.yaml

5. Install the linkerd-deps Helm chart to set up the CRDs and CNI

helm install linkerd-deps ./linkerd-deps --namespace linkerd-deps --create-namespace

6. Install the linkerd control plane

helm install linkerd-control-plane ./linkerd-control-plane --namespace linkerd

7. Create some pods with the proxy injected and let them run

kubectl apply -f ./netshoot.yaml

8. Wait and observe...

• You should see the Identity pods picking up their new issuer certs regularly (every 10 mins)

• After about 30 mins, a new Root CA certificate will be issued

• And within 10 mins of that, a new issuer cert signed by the new Root CA will be issued

• and this will be picked up by the Identity pods with no complaints about the lack of the correct CA in the trust bundle.

• Verify that the Identity pod is using a cert signed by the new Root CA using linkerd identity

• Everything will continue to run normally.

• You can restart the identity pod and it will start up without an error, still with an incorrect trust bundle. It will continue to issue new workload certs signed by the correct Root CA, and will continue to refresh its own Issuer certificate

• Afer about 1h, when the original Root CA certificate expires, the Issuer pod will log errors and stop issuing certificates:

time="2025-10-03T09:47:20Z" level=warning msg="Skipping issuer update as certs could not be read from disk: failed to verify issuer credentials for 'identity.linkerd.cluster.local' with trust anchors: x509: certificate has expired or is not yet valid: current time 2025-10-03T09:47:20Z is after 2025-10-03T09:46:58Z - Current Time : 2025-10-03 09:47:20.096737574 +0000 UTC m=+1531.833096412 - Invalid before 2025-10-03 09:47:03 +0000 UTC - Invalid After 2025-10-03 10:47:03 +0000 UTC"
time="2025-10-03T09:50:31Z" level=error msg="could not process CSR because of CA cert validation failure: x509: certificate has expired or is not yet valid: current time 2025-10-03T09:50:31Z is after 2025-10-03T09:46:58Z - Current Time : 2025-10-03 09:50:31.253898193 +0000 UTC m=+1722.990257031 - Invalid before 2025-10-03 09:37:03 +0000 UTC - Invalid After 2025-10-03 10:37:03 +0000 UTC - CSR Identity : default.default.serviceaccount.identity.linkerd.cluster.local"

• If the pod is restarted, it will go into a crashloop

• Get things working again by updating the trust bundle!