Added support for trust anchors issued by an external CA (for example AWS
Private CA). When cert-manager appends the issuing chain to tls.crt, the
operator now uses only the first certificate as the trust anchor or active
issuer, instead of failing every reconcile.
Fixed an issue where, with a trust anchor issued by an external subordinate
CA, the subordinate CA was published to linkerd-identity-trust-roots as a
mesh trust root. Upgrading removes it from the published bundle. The
linkerd-trust bundle command likewise emits only the trust anchor.
Fixed detection of premature identity issuer rotations (for example an
out-of-band cert-manager or manual renewal) during the early rotation phases.
These are now reported through the OutOfOrderIssuerRotation status condition
in every phase.
Controller error logs now include the full chain of underlying causes.
The operator pod is now annotated with linkerd.io/inject: disabled so that
it is never meshed.
