For anyone who finds this later, this was a case where the upgrade to cert-manager 1.18 broke a setup that had only a single entry in trust-manager’s sources list. The current Linkerd docs on setting up cert-manager and trust-manager have a lot more detail on the recommended setup.