Certificate rotation in kube-system/extension-apiserver-authentication configmap breaks linkerd-viz/tap APIService

[Tolsto]

What is the issue?

After a certificate rotation of requestheader-client-ca-file in in the kube-system/extension-apiserver-authentication configmap, the linkerd-viz/tap APIService doesn't work anymore. Restarting the linkerd-viz/tap pod fixes the issue.

How can it be reproduced?

Rotate CA in requestheader-client-ca-file and try to use linkerd-viz/tap APIService.

Logs, error output, etc

2024/10/15 13:59:04 http: TLS handshake error from 10.5.19.21:46612: tls: failed to verify client certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "agg-ca")

output of linkerd check -o short

linkerd-config
--------------
× control plane CustomResourceDefinitions exist
    CRD servers.policy.linkerd.io is missing version v1beta2, missing externalworkloads.workload.linkerd.io
    see https://linkerd.io/2/checks/#l5d-existence-crd for hints
Status check results are ×

Environment

• AKS 1.29.2
• linkerd stable-2.14.9

Possible solution

Establish a watch on the configmap.

Additional context

No response

Would you like to work on fixing this bug?

None