How to set identity.issuer.crtExpiry if cert-manager rotates the issuer cert?

[sysarch-repo]

Cert-Manager can be used to rotate the certificate of the issuer - see https://linkerd.io/2.10/tasks/automatically-rotating-control-plane-tls-credentials/

At the same time, identity.issuer.crtExpiry must be provided during linkerd install and the value must match the expiry date of the issuer cert.

How does this align? The expectation would be making the identity.issuer.crtExpiry parameter optional. Thoughts?

[alpeb]

Assuming you're using Helm, the way to flag the templates that you'd like an external method to generate your issuer cert is to use --set identity.issuer.scheme=kubernetes.io/tls. In that case, identity.issuer.crtExpiry is not required; you can check that in the issuer template's logic.

[sysarch-repo]

@alpeb, thanks for the prompt answer. Very appreciated!