linkerd check complains about authority of proxy injector

[HenrikOssipoff]

Hi,

Currently setting up a cluster with linkerd, and been following the various guide of the official documentation. Namely regarding the trust anchor and webhooks:

https://linkerd.io/2.13/tasks/automatically-rotating-control-plane-tls-credentials/
https://linkerd.io/2.13/tasks/automatically-rotating-webhook-tls-credentials/

However, after having been through all of this, linkerd check gives me the following:

linkerd-webhooks-and-apisvc-tls
-------------------------------
× proxy-injector webhook has valid cert
    cert is not issued by the trust anchor: x509: certificate signed by unknown authority
    see https://linkerd.io/2.13/checks/#l5d-proxy-injector-webhook-cert-valid for hints

This makes totally sense, since (per the above guides), the proxy-injector is signed using the webhook CA, not the trust anchor.

Now my question is:

• Should this warning simply be ignored from the check command?
• Should the guide have been using the trust anchor instead?

[HenrikOssipoff]

Based on further tests, I'm quite positive that my approach isn't correct, since creating a deployment in the cluster results in this event on the replicaset: Error creating: Internal error occurred: failed calling webhook "linkerd-proxy-injector.linkerd.io": failed to call webhook: Post "https://linkerd-proxy-injector.linkerd.svc:443/?timeout=10s": x509: certificate signed by unknown authority

But this leads me to: should linkerd-proxy-injector certificate in the webhook guide simply be signed with my trust anchor issuer instead of the webhook issuer? What about the other certificates?

[HenrikOssipoff]

I would out what was wrong, which was on my end. I was mislead by the message saying that the cert was not issued by the trust anchor, and misunderstood its meaning.

I had mistakenly made the linkerd installation exactly using the trust anchor as the proxy injector ca bundle. When I set this to the webhook certificate, everything worked as it should.

Sorry for the noise!