How to avoid a Linkerd certificate expiry incident

Linkerd is one of the most popular service meshes for Kubernetes. It’s super lightweight and easy to use, and from what we’ve heard, it’s the mesh of choice for Opta users.

One of Linkerd’s core features is its no-config mutual TLS that makes sure that all inter-service communication is encrypted. This is an amazing feature, but setting it up correctly requires some careful consideration and continuous monitoring.

By default, the certificates that Linkerd creates to enable mTLS expire after only one year. This means that suddenly, after only a year of usage, your services might stop communicating with each other leaving you to scramble to recreate the certificates. It’s easy to see why this could be a problem.

Get Nitin Aggarwal’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To avoid this, we recommend that you generate your own certificates and pass them to Linkerd with a longer expiration date (we use 10 years in Opta).

Here are some resources which are helpful:

• Guide to generate your own certificates
• Guide to rotate certificates without any downtime
• Documentation on how mTLS works in Linkerd
• Opta’s Terraform module with the right setup