diff --git a/pkg/healthcheck/healthcheck.go b/pkg/healthcheck/healthcheck.go index c74d98ae3..6628f6c8d 100644 --- a/pkg/healthcheck/healthcheck.go +++ b/pkg/healthcheck/healthcheck.go @@ -1625,11 +1625,6 @@ func (hc *HealthChecker) checkCertificatesConfig(ctx context.Context) (*tls.Cred data, err = issuercerts.FetchIssuerData(ctx, hc.kubeAPI, values.GetGlobal().IdentityTrustAnchorsPEM, hc.ControlPlaneNamespace) } else { data, err = issuercerts.FetchExternalIssuerData(ctx, hc.kubeAPI, hc.ControlPlaneNamespace) - // ensure trust anchors in config matches what's in the secret - if data != nil && strings.TrimSpace(values.GetGlobal().IdentityTrustAnchorsPEM) != strings.TrimSpace(data.TrustAnchors) { - errFormat := "IdentityContext.TrustAnchorsPem does not match %s in %s" - err = fmt.Errorf(errFormat, k8s.IdentityIssuerTrustAnchorsNameExternal, k8s.IdentityIssuerSecretName) - } } if err != nil { diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go index 2e7f7d228..bb49082a6 100644 --- a/pkg/healthcheck/healthcheck_test.go +++ b/pkg/healthcheck/healthcheck_test.go @@ -2606,36 +2606,6 @@ func TestLinkerdIdentityCheckCertConfig(t *testing.T) { schemeInConfig: string(corev1.SecretTypeTLS), expectedOutput: []string{"linkerd-identity-test-cat certificate config is valid: key ca.crt containing the trust anchors needs to exist in secret linkerd-identity-issuer if --identity-external-issuer=true"}, }, - { - checkDescription: "does not get influenced by newline differences between trust anchors (missing newline in configMap)", - tlsSecretScheme: string(corev1.SecretTypeTLS), - schemeInConfig: string(corev1.SecretTypeTLS), - expectedOutput: []string{"linkerd-identity-test-cat certificate config is valid"}, - configMapIssuerDataModifier: func(issuerData issuercerts.IssuerCertData) issuercerts.IssuerCertData { - issuerData.TrustAnchors = strings.TrimSpace(issuerData.TrustAnchors) - return issuerData - }, - }, - { - checkDescription: "does not get influenced by newline differences between trust anchors (extra newline in configMap)", - tlsSecretScheme: string(corev1.SecretTypeTLS), - schemeInConfig: string(corev1.SecretTypeTLS), - expectedOutput: []string{"linkerd-identity-test-cat certificate config is valid"}, - configMapIssuerDataModifier: func(issuerData issuercerts.IssuerCertData) issuercerts.IssuerCertData { - issuerData.TrustAnchors = issuerData.TrustAnchors + "\n" - return issuerData - }, - }, - { - checkDescription: "does not get influenced by newline differences between trust anchors (missing newline in secret)", - tlsSecretScheme: string(corev1.SecretTypeTLS), - schemeInConfig: string(corev1.SecretTypeTLS), - expectedOutput: []string{"linkerd-identity-test-cat certificate config is valid"}, - tlsSecretIssuerDataModifier: func(issuerData issuercerts.IssuerCertData) issuercerts.IssuerCertData { - issuerData.TrustAnchors = strings.TrimSpace(issuerData.TrustAnchors) - return issuerData - }, - }, { checkDescription: "fails when trying to parse trust anchors from secret (extra newline in secret)", tlsSecretScheme: string(corev1.SecretTypeTLS),