Skipping ports in linkerd > 2.8

[lynshi]

We are currently using linkerd2 2.8.1 in a setup where some Pods have their own TLS with self-signed certificates. In 2.8.1, if Pod A has self-signed TLS on port 1000, with Service A linking to containerPort 1000 from 443, then we add 1000 to --skip-inbound-ports and everything works fine.

In linkerd 2.9 and 2.10, we are seeing the following errors in linkerd-proxy:

[   975.821558s]  WARN ThreadId(01) server{orig_dst=<IP address>}: rustls::session: Sending fatal alert BadCertificate

and we cannot connect to Pod A via Service A. To resolve this issue, we have to also add 443 to --skip-outbound-ports on the connecting Pod. Does this mean that (after linkerd 2.8) the proxy on the Pod with the outgoing connection is validating the TLS certificate, so the proxy must be disabled on both ends?

[adleong]

Thank you @lynshi! I've created #6937 to investigate this.