Feature: Linkerdctl rotates the trust anchor secret

Scenario: Upgrade of Linkerd
    Given a cluster with an older version of Linkerd
    When an upgrade of Linkerd is performed
    Then the linkerd version is updated
    And the trust anchor secret is patched with a new value
    And the ca bundle in the identity configmap is updated 
    And the new trust anchor secret lifetime is 2 years
    And the pods will be healthy
    And the identity certificate and secret are re-created

Scenario: Multiple successive upgrades of Linkerd
    Given a cluster with a Linkerd version at least a couple of releases out of date
    When the first upgrade of Linkerd is ran
    And the second upgrade of Linkerd is ran
    But the proxy certificates had not yet been re-issued after the first upgrade
    Then some meshed pods might not be able to communicate
    But after some time, the old pods will get re-meshed
    And communication between pods will be restored