Adding Linkerd in Barman Plugin

[beingvishalt]

@dosu,

I am using CNPG 1.26 with Barman plugin 0.9.0 in azure ak8s cluster.
I am using Barman plugin to take backups on azure blob storage.

Barman is using tls certificate for https communication. Can we remove that tls and certificate from Barman and CNPG deployments so we can use https traffic and on the top of that we are planning to use linkerd mtls.

If yes how to do that?

[dosubot]

You can't remove TLS and certificates from Barman and CNPG deployments, even if you use Linkerd mTLS. Both CloudNativePG and the Barman plugin require TLS certificates for secure communication between the operator and plugins, and for HTTPS connections to Azure Blob Storage. This is enforced by the platform and is not optional—TLS certificates must be present and trusted by both sides, and there is no supported way to disable or bypass this requirement, even with a service mesh like Linkerd in place [docs]source.

Linkerd mTLS only secures traffic between pods at the network layer. If the application (like Barman or CNPG) already uses HTTPS/TLS, Linkerd treats that traffic as opaque TCP and cannot add its own mTLS on top or replace the application's TLS. So, you still need to manage certificates for both plugin communication and Azure backups [charts issue].

You can use Linkerd for pod-to-pod encryption and observability, but you must continue to configure and manage TLS certificates for CNPG and Barman as described in the official documentation. Disabling certificate creation in Helm charts only affects automatic certificate generation, not the enforcement of TLS itself [charts issue].

If you want to use Linkerd with CNPG, make sure to add the correct annotations for sidecar injection and graceful shutdown, but keep TLS/certificates enabled for all CNPG and Barman plugin communications [cloudnative-pg issue].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[beingvishalt]

I know how to add Linkerd in CNPG DB Cluster but I also want to add it in Barman Deployment . Can we do that ? If Yes, How?
and cnpg-cloudnative-pg deployment at startup does it require certificate webhook compulsary ?
@dosu

[dosubot]

Yes, you can add Linkerd to the Barman deployment. To do this, add the annotation linkerd.io/inject: "enabled" under spec.template.metadata.annotations in your Barman Cloud deployment manifest. This will enable Linkerd sidecar injection for the Barman pod, just like you would for other workloads in your cluster.

For example, in your deployment YAML, add:

spec:
  template:
    metadata:
      annotations:
        linkerd.io/inject: "enabled"

Keep in mind: you must still configure and mount TLS certificates for secure communication between CNPG and the Barman plugin, as Linkerd cannot replace application-level TLS—these certificates are required for both plugin communication and Azure Blob Storage backups. Linkerd will provide pod-to-pod mTLS and observability, but the application-level TLS setup remains mandatory for Barman and CNPG to function correctly.

If your deployment has custom networking, init containers, or other advanced settings, review those for compatibility with Linkerd injection and test in a non-production environment first.
Reference: deployment manifest location and annotation

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}