--- title: "Hands off Linkerd certificate rotation" url: https://daily.dev/posts/hands-off-linkerd-certificate-rotation-grttnzwwm source_url: https://linkerd.io/2025/10/20/hands-off-linkerd-certificate-rotation type: article source: "Linkerd" published: 2026-08-23T12:23:33.320Z updated: 2026-08-23T12:54:52.580Z tags: ["kubernetes", "infrastructure", "service-mesh"] reading_time: 7 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hands off Linkerd certificate rotation **[Linkerd](https://daily.dev/sources/linkerd)** · 7 min read · 0 upvotes · 0 comments ## Summary A platform engineer shares a fully automated Linkerd certificate rotation pipeline built after an unexpected cert-manager change caused long-standing certificates to rotate unexpectedly. The solution uses a custom Helm chart to provision the trust anchor, identity issuer, and trust bundle via cert-manager, plus a set of shell scripts bundled into a Docker container that rotates certs, restarts the control plane and data plane pods, and updates the trust bundle. Everything runs on a monthly Kubernetes CronJob with RBAC configured for a dedicated service account, using a 120-day certificate duration with 60-day renewal and 30-day forced rotation to leave a safety buffer against automation failures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I fully automate Linkerd trust anchor certificate rotation without manual kubectl intervention? Build a CronJob that runs a sequence of scripts: rotate the trust anchor and identity issuer with cmctl, restart the Linkerd control plane and viz deployments, restart all namespaces annotated with linkerd.io/inject=enabled, then remove the old anchor from the trust bundle. Package these into a Docker container based on bitnami/kubectl with cmctl installed, and schedule it via a Kubernetes CronJob with a dedicated service account and RBAC rules for certificates, deployments, and secrets. _daily.dev surfaces practical service mesh automation writeups like this for engineers hardening Kubernetes clusters._ ### Why does rotating the Linkerd trust anchor require manual intervention while the identity issuer does not? Rotating the identity issuer is handled entirely by cert-manager on its own, but rotating the trust anchor requires restarting both the Linkerd control plane and all meshed proxies while managing the trust bundle, which cert-manager cannot trigger by itself. This gap is why teams need custom automation, such as scripts or CronJobs, to handle the required restarts after cert-manager rotates the trust anchor. _Track service mesh operational gotchas like this one on daily.dev before they cause an outage._ ### What certificate duration and renewal window should I use for Linkerd cert-manager rotation to avoid downtime? A working configuration issues certificates with a 120-day duration and renews them after 60 days, giving a 60-day window to restart the control plane and meshed pods before the old certificates expire. On top of that, a CronJob forces rotation every 30 days, keeping certificates fresh while leaving a substantial buffer in case the automation fails. _daily.dev helps engineers compare real-world cert rotation schedules when hardening Kubernetes TLS automation._ ## Similar posts on daily.dev - [Amazon EKS now supports certificate authority \(CA\) rotation with automated lifecycle management](https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk) · AWS · 1 upvotes · 0 comments - [Implement mTLS and zero trust with cert-manager and trust-manager](https://daily.dev/posts/implement-mtls-and-zero-trust-with-cert-manager-and-trust-manager-1ul1ddtsk) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#service-mesh](https://daily.dev/tags/service-mesh) [View this post on daily.dev](https://daily.dev/posts/hands-off-linkerd-certificate-rotation-grttnzwwm)