Add webhook cert auto-rotating

2025-09-23 23:49:51 +02:00
parent 8a9425b150
commit 9dce6c79ea
10 changed files with 199 additions and 0 deletions
--- a/linkerd-viz/templates/tap-injector-certificate.yaml
+++ b/linkerd-viz/templates/tap-injector-certificate.yaml
@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: linkerd-tap-injector
+spec:
+  secretName: tap-injector-k8s-tls
+  duration: 24h
+  renewBefore: 1h
+  issuerRef:
+    name: webhook-issuer
+    kind: Issuer
+  commonName: tap-injector.linkerd-viz.svc
+  dnsNames:
+  - tap-injector.linkerd-viz.svc
+  isCA: false
+  privateKey:
+    algorithm: ECDSA
+  usages:
+  - server auth