Flux部署Linkerd集成Cert Manager时提示缺失identity issuer证书

使用Flux部署Helm版本Linkerd，搭配默认配置的Cert Manager实现TLS证书自动轮换，相关配置如下：

release.yaml #

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: linkerd
  namespace: linkerd
  
spec:
  interval: 5m
  values:
    identity.issuer.scheme: kubernetes.io/tls
    installNamespace: false
    
  valuesFrom:
  - kind: Secret
    name: linkerd-trust-anchor
    valuesKey: tls.crt
    targetPath: identityTrustAnchorsPEM
  chart:
    spec:
      chart: linkerd2
      version: "2.11.2"
      sourceRef:
        kind: HelmRepository
        name: linkerd
        namespace: linkerd
      interval: 1m

source.yaml #

---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: linkerd
  namespace: linkerd
spec:
  interval: 5m0s
  url: https://helm.linkerd.io/stable

linkerd-trust-anchor.yaml #

apiVersion: v1
data:
  tls.crt: base64encoded
  tls.key: base64encoded
kind: Secret
metadata:
  name: linkerd-trust-anchor
  namespace: linkerd
type: kubernetes.io/tls

根证书生成命令：

step certificate create root.linkerd.cluster.local ca.crt ca.key \
  --profile root-ca --no-password --insecure

issuer.yaml #

---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: linkerd-trust-anchor
  namespace: linkerd
spec:
  ca:
    secretName: linkerd-trust-anchor
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: linkerd-identity-issuer
  namespace: linkerd
spec:
  secretName: linkerd-identity-issuer
  duration: 48h
  renewBefore: 25h
  issuerRef:
    name: linkerd-trust-anchor
    kind: Issuer
  commonName: identity.linkerd.cluster.local
  dnsNames:
  - identity.linkerd.cluster.local
  isCA: true
  privateKey:
    algorithm: ECDSA
  usages:
  - cert sign
  - crl sign
  - server auth
  - client auth

故障现象 #

Flux调和资源时HelmRelease抛出错误：

Helm install failed: execution error at (linkerd2/templates/identity.yaml:19:21): Please provide the identity issuer certificate

手动执行以下helm命令可正常部署：

helm install linkerd2   \
--set-file identityTrustAnchorsPEM=ca.crt   \
--set identity.issuer.scheme=kubernetes.io/tls   \
--set installNamespace=false   linkerd/linkerd2   \
-n linkerd

不使用Cert Manager、手动创建证书Secret并通过valuesFrom显式传入证书和私钥参数时，也可部署成功，可用配置片段如下：

valuesFrom:
  - kind: Secret
    name: linkerd-trust-anchor
    valuesKey: tls.crt
    targetPath: identityTrustAnchorsPEM
  - kind: Secret
    name: linkerd-identity-issuer-2
    valuesKey: tls.crt
    targetPath: identity.issuer.tls.crtPEM
  - kind: Secret
    name: linkerd-identity-issuer-2
    valuesKey: tls.key
    targetPath: identity.issuer.tls.keyPEM

配置存在两处核心遗漏，导致自动部署失败：

• 必填参数映射缺失：Linkerd 2.11的Helm Chart在模板渲染阶段会强制校验identity.issuer.tls.crtPEM（身份签发者证书）和identity.issuer.tls.keyPEM（身份签发者私钥）两个参数，无论是否设置identity.issuer.scheme=kubernetes.io/tls，都不会自动从集群读取同名Secret填充参数。当前配置仅传入了根证书identityTrustAnchorsPEM，没有配置这两个值的读取路径，直接触发模板校验报错。
• 无资源部署顺序依赖：Flux默认并行调和所有资源，HelmRelease可能在Cert Manager完成linkerd-identity-issuer Certificate资源调和、生成对应TLS Secret之前就开始执行安装逻辑，此时即使配置了参数映射，也会因为Secret不存在导致取值失败。

手动执行helm命令能成功，是因为操作时Cert Manager已经提前生成了linkerd-identity-issuer Secret，满足了Chart的校验要求；手动传参部署能成功，也侧面印证了两个证书参数的映射是必填项。

1. 修改release.yaml中的valuesFrom段，补充身份签发者证书、私钥的参数映射，指向Cert Manager生成的Secret：

valuesFrom:
  - kind: Secret
    name: linkerd-trust-anchor
    valuesKey: tls.crt
    targetPath: identityTrustAnchorsPEM
  # 新增以下两个映射项
  - kind: Secret
    name: linkerd-identity-issuer
    valuesKey: tls.crt
    targetPath: identity.issuer.tls.crtPEM
  - kind: Secret
    name: linkerd-identity-issuer
    valuesKey: tls.key
    targetPath: identity.issuer.tls.keyPEM

2. 在HelmRelease的spec段增加dependsOn配置，强制Flux等待证书相关资源调和完成后再部署Linkerd，避免读取Secret失败：

spec:
  interval: 5m
  # 新增依赖配置
  dependsOn:
    - name: linkerd-identity-issuer
      namespace: linkerd
  values:
    identity.issuer.scheme: kubernetes.io/tls
    installNamespace: false
  # 其余原有配置保持不变

配置修改后Flux会自动重新调和，等待Cert Manager签发的证书Secret就绪后完成Linkerd部署。后续证书轮换时，Cert Manager更新Secret内容后Flux会自动感知变更，重新调和HelmRelease，实现证书自动轮换。

内容的提问来源于stack exchange，提问作者Diego Alejandro Llanos Gareca