Identity Controller Service/identity-issuer-expiry

[visdubey]

I would like to know the effect of linkerd.io/identity-issuer-expiry mentioned in the manifest file. I have created new cert.pem/key.pem and replaced it in manifest file. Would this date be only informational purpose or it will cause any effect if we change it manually?

kind: Secret
apiVersion: v1
metadata:
name: linkerd-identity-issuer
namespace: linkerd
labels:
linkerd.io/control-plane-component: identity
linkerd.io/control-plane-ns: linkerd
annotations:
linkerd.io/created-by: linkerd/cli stable-2.7.1
linkerd.io/identity-issuer-expiry: 2021-09-10T16:07:10Z
data:
crt.pem:
key.pem:

[grampelberg]

AFAICT from the code, this isn't being used anywhere today. It looks like we're adding it just for metadata so that you don't need to extract the certificate to figure out what the expiration is.

[visdubey]

Thanks, so this metadata in manifest is valid to see trust anchor and issuer certificates validity? is there any other way to check expiry of these certificates in manifest file itself?

[grampelberg]

Sure, you could download the cert and inspect it.

[visdubey]

Instead of running below to see if certs are in within validity period, do we have anything which will show expiration date of both certs after installation. I would like to know how to extract these from manifest file?
linkerd check --proxy
√ issuer cert is valid for at least 60 days

[grampelberg]

You'd fetch the manifest with kubectl and use something like step or openssl to inspect the certificate and get the validity.

[visdubey]

What will happen to K8s cluster if linkerd certs are expired? Applications will stop working or those will work normally and linkerd won't be operational?