Linkerd-config cannot be found by Linkerd check even though linkerd is installed

Hi all,
I’m having the following issue. I used the BEL operator to install version 2.16.0 of Enterprise Linkerd. Everything is working fine as far as I can see but still when I run:
linkerd check
This is the result I get:

linkerd-existence
-----------------
× 'linkerd-config' config map exists
    configmaps "linkerd-config" not found
    see https://linkerd.io/2/checks/#l5d-existence-linkerd-config for hints

The linkerd-config configmap is available and I also checked if all the labels are correct and I think they are:

apiVersion: v1
data:
  linkerd-crds-chart-version: linkerd-crds-1.0.0-edge
  values: |
    clusterDomain: cluster.local
    clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16,fd00::/8
    cniEnabled: false
    commonLabels: {}
    controlPlaneTracing: false
    controlPlaneTracingNamespace: linkerd-jaeger
    controller:
      podDisruptionBudget:
        maxUnavailable: 1
    controllerGID: -1
    controllerImage: ${harbor_registry}/google-proxy/buoyantio/controller
    controllerImageVersion: ""
    controllerLogFormat: plain
    controllerLogLevel: info
    controllerReplicas: 3
    controllerResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    controllerUID: 2103
    debugContainer:
      image:
        name: ${harbor_registry}/google-proxy/buoyantio/debug
        pullPolicy: ""
        version: edge-24.8.2
    deploymentStrategy:
      rollingUpdate:
        maxSurge: 25%
        maxUnavailable: 1
    destinationController:
      meshedHttp2ClientProtobuf:
        keep_alive:
          interval:
            seconds: 10
          timeout:
            seconds: 3
          while_idle: true
    destinationResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    disableHeartBeat: false
    disableIPv6: true
    enableEndpointSlices: true
    enableH2Upgrade: true
    enablePSP: false
    enablePodAntiAffinity: true
    enablePodDisruptionBudget: true
    enablePprof: false
    global: {}
    heartbeatResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    highAvailability: true
    identity:
      externalCA: true
      issuer:
        clockSkewAllowance: 20s
        issuanceLifetime: 24h0m0s
        scheme: kubernetes.io/tls
        tls:
          crtPEM: ""
      kubeAPI:
        clientBurst: 200
        clientQPS: 100
      serviceAccountTokenProjection: true
    identityResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 10Mi
    identityTrustAnchorsPEM: ca.crt
    identityTrustDomain: cluster.local
    imagePullPolicy: IfNotPresent
    imagePullSecrets: []
    kubeAPI:
      clientBurst: 200
      clientQPS: 100
    linkerdVersion: enterprise-2.16.0
    networkValidator:
      connectAddr: ""
      enableSecurityContext: true
      listenAddr: ""
      logFormat: plain
      logLevel: debug
      timeout: 10s
    nodeSelector:
      kubernetes.io/os: linux
    podAnnotations: {}
    podLabels: {}
    podMonitor:
      controller:
        enabled: true
        namespaceSelector: |
          matchNames:
            - {{ .Release.Namespace }}
            - linkerd-viz
            - linkerd-jaeger
      enabled: true
      labels: {}
      proxy:
        enabled: true
      scrapeInterval: 10s
      scrapeTimeout: 10s
      serviceMirror:
        enabled: true
    policyController:
      image:
        name: ${harbor_registry}/google-proxy/buoyantio/policy-controller
        pullPolicy: ""
        version: ""
      logLevel: info
      probeNetworks:
      - 0.0.0.0/0
      - ::/0
      resources:
        cpu:
          limit: ""
          request: ""
        ephemeral-storage:
          limit: ""
          request: ""
        memory:
          limit: ""
          request: ""
    policyControllerResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    policyValidator:
      caBundle: ""
      crtPEM: ""
      externalSecret: false
      injectCaFrom: ""
      injectCaFromSecret: ""
      namespaceSelector:
        matchExpressions:
        - key: config.linkerd.io/admission-webhooks
          operator: NotIn
          values:
          - disabled
    priorityClassName: ""
    profileValidator:
      caBundle: ""
      crtPEM: ""
      externalSecret: false
      injectCaFrom: ""
      injectCaFromSecret: ""
      namespaceSelector:
        matchExpressions:
        - key: config.linkerd.io/admission-webhooks
          operator: NotIn
          values:
          - disabled
    prometheusUrl: ""
    proxy:
      await: true
      control:
        streams:
          idleTimeout: 5m
          initialTimeout: 3s
          lifetime: 1h
      cores: 0
      defaultInboundPolicy: all-unauthenticated
      disableInboundProtocolDetectTimeout: false
      disableOutboundProtocolDetectTimeout: false
      enableExternalProfiles: false
      enableShutdownEndpoint: false
      gid: -1
      image:
        name: ${harbor_registry}/google-proxy/buoyantio/proxy
        pullPolicy: ""
        version: ""
      inbound:
        server:
          http2:
            keepAliveInterval: 10s
            keepAliveTimeout: 3s
      inboundConnectTimeout: 100ms
      inboundDiscoveryCacheUnusedTimeout: 90s
      livenessProbe:
        initialDelaySeconds: 10
        timeoutSeconds: 1
      logFormat: plain
      logHTTPHeaders: "off"
      logLevel: warn,linkerd=info,hickory=error
      nativeSidecar: false
      opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
      outbound:
        server:
          http2:
            keepAliveInterval: 10s
            keepAliveTimeout: 3s
      outboundConnectTimeout: 1000ms
      outboundDiscoveryCacheUnusedTimeout: 5s
      ports:
        admin: 4191
        control: 4190
        inbound: 4143
        outbound: 4140
      readinessProbe:
        initialDelaySeconds: 2
        timeoutSeconds: 1
      requireIdentityOnInboundPorts: ""
      resources:
        cpu:
          limit: ""
          request: 100m
        ephemeral-storage:
          limit: ""
          request: ""
        memory:
          limit: 250Mi
          request: 20Mi
      shutdownGracePeriod: ""
      startupProbe:
        failureThreshold: 120
        initialDelaySeconds: 0
        periodSeconds: 1
      uid: 2102
      waitBeforeExitSeconds: 0
    proxyInit:
      closeWaitTimeoutSecs: 0
      ignoreInboundPorts: 4567,4568
      ignoreOutboundPorts: 4567,4568
      image:
        name: ${harbor_registry}/google-proxy/buoyantio/proxy-init
        pullPolicy: ""
        version: enterprise-2.16.0
      iptablesMode: legacy
      kubeAPIServerPorts: 443,6443
      logFormat: ""
      logLevel: ""
      privileged: true
      runAsGroup: 65534
      runAsRoot: true
      runAsUser: 65534
      skipSubnets: ""
      xtMountPath:
        mountPath: /run
        name: linkerd-proxy-init-xtables-lock
    proxyInjector:
      caBundle: ""
      crtPEM: ""
      externalSecret: false
      injectCaFrom: ""
      injectCaFromSecret: ""
      namespaceSelector:
        matchExpressions:
        - key: config.linkerd.io/admission-webhooks
          operator: NotIn
          values:
          - disabled
        - key: kubernetes.io/metadata.name
          operator: NotIn
          values:
          - kube-system
          - cert-manager
      objectSelector:
        matchExpressions:
        - key: linkerd.io/control-plane-component
          operator: DoesNotExist
        - key: linkerd.io/cni-resource
          operator: DoesNotExist
      timeoutSeconds: 10
    proxyInjectorResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    revisionHistoryLimit: 10
    runtimeClassName: ""
    spValidatorResources:
      cpu:
        request: 100m
      memory:
        limit: 250Mi
        request: 50Mi
    webhookFailurePolicy: Fail
kind: ConfigMap
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm enterprise-2.16.0
    meta.helm.sh/release-name: linkerd-control-plane
    meta.helm.sh/release-namespace: linkerd
  creationTimestamp: "2024-08-08T12:18:31Z"
  labels:
    app.kubernetes.io/managed-by: Helm
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
  name: linkerd-config
  namespace: linkerd
  resourceVersion: "1429404316"
  uid: 3309184f-6a9e-4fac-80f0-4571390290ad

Hi, it could be that the account under which you’re running linkerd check doesn’t have privileges to list ConfigMaps… Can you try retrieving the ConfigMap with kubectl using the default kubeconfig for your current user environment?