linkerd control plane namespace labels & annotations

[bdols]

I have been installilng linkerd via helm. I noticed in the linkerd-control-plane helm chart that the namespace.yaml has the following but because .Release.Service is not Helm it won't render this:

    linkerd.io/inject: disabled
  labels:
    linkerd.io/is-control-plane: "true"
    config.linkerd.io/admission-webhooks: disabled
    linkerd.io/control-plane-ns: {{.Release.Namespace}}

how important are these to set these values for the linkerd namespace for helm installs. should it be set before the install? after? is there any functionality that relies on these values? will they be going away in the future?

[alpeb]

That's a good spot 👍 The ones you point out are not required, and we should indeed clean them up at some point.
OTOH, you'll see that for 2.13 we've added a label pod-security.kubernetes.io/enforce that you'll have to add when you create the linkerd namespace, if you require using Pod Security Admission in you cluster namespaces.