v1.0.0-beta.2

Thu, 15 Oct 2026 00:00:00 +0000

Added support for trust anchors issued by an external CA (for example AWS Private CA). When cert-manager appends the issuing chain to tls.crt, the operator now uses only the first certificate as the trust anchor or active issuer, instead of failing every reconcile.
Fixed an issue where, with a trust anchor issued by an external subordinate CA, the subordinate CA was published to linkerd-identity-trust-roots as a mesh trust root. Upgrading removes it from the published bundle. The linkerd-trust bundle command likewise emits only the trust anchor.
Fixed detection of premature identity issuer rotations (for example an out-of-band cert-manager or manual renewal) during the early rotation phases. These are now reported through the OutOfOrderIssuerRotation status condition in every phase.
Controller error logs now include the full chain of underlying causes.
The operator pod is now annotated with linkerd.io/inject: disabled so that it is never meshed.
Update dependencies to address vulnerabilities:
- RUSTSEC-2026-0349 (maps to GHSA-w44r-93j7-qv28)
- RUSTSEC-2026-0348 (maps to GHSA-h2v8-394m-p7vv)
- RUSTSEC-2026-0346 (maps to GHSA-c8m5-c952-6cm4)
- RUSTSEC-2026-0285 (maps to GHSA-2mjx-qc3c-rqvc)
- RUSTSEC-2026-0258 (maps to GHSA-q83h-524g-xf6h)
- RUSTSEC-2023-0071 (maps to CVE-2023-49092)
Update dependencies to address the soundness advisories RUSTSEC-2026-0190 and RUSTSEC-2026-0221, and replace the unmaintained rustls-pemfile crate (RUSTSEC-2025-0134).

Trust-rotation operator | Release notes