diff --git a/modules/k8s.nix b/modules/k8s.nix
index bfddf17..88cd9c4 100644
--- a/modules/k8s.nix
+++ b/modules/k8s.nix
@@ -5,6 +5,8 @@ let
 
   pki = import ./pki.nix { inherit pkgs; ca = cfg.initca; };
 
+  linkerd-certs = import ./linkerd-certs.nix { inherit pkgs; };
+
   masterAddress = cfg.k8s.master.address;
 
   apiserverAddress = "https://${masterAddress}:4443";
@@ -43,7 +45,6 @@ let
             #   $(date)
             # Charts in ${kubernetes-charts}/share/kubernetes-charts
 
-
             vars=(
                 initca="${pki.initca}"
                 apiserver="${cfg.k8s.master.name}"
@@ -54,10 +55,14 @@ let
                 acme_email="${cfg.k8s.charts.acme_email}"
                 grafana_smtp_user="$(echo -n ${cfg.k8s.charts.grafana_smtp_user} | base64 -w0)"
                 grafana_smtp_password="$(echo -n ${cfg.k8s.charts.grafana_smtp_password} | base64 -w0)"
+                linkerd_identity_ca="${linkerd-certs.identity}"
+                linkerd_webhook_ca="${linkerd-certs.webhook}"
             )
 
             EOF
             cat << '"'"'EOF'"'"'
+            apply=''${KUBECTL_CMD:-apply}
+
             substitute_all () {
                 local x i k v subs
                 x="$(</dev/stdin)"
@@ -84,36 +89,35 @@ let
             }
 
             kubectl_apply () {
-                local x namespace
-                namespace="$1"; shift
+                local x
                 x="$(</dev/stdin)"
-                create_namespace $namespace
+                create_namespace
                 echo "$x" | \
                   substitute_defaults | \
-                  kubectl -n $namespace apply $@ -f -
+                  kubectl -n $namespace $apply $@ -f -
             }
 
             kubectl_apply_files () {
-                local i namespace charts
-                namespace=$1; shift
+                local i charts
                 charts=("$@")
                 for i in "''${charts[@]}"; do
-                   cat "$i" | kubectl_apply $namespace
+                   cat "$i" | kubectl_apply
                 done
             }
 
             helm_apply () {
-                local namespace name chart
-                namespace="$1"
-                name="$2"
-                chart="$3"
+                local name chart
+                name="$1"
+                chart="$2"
                 create_namespace $namespace
                 cat values.yaml | \
                   substitute_defaults | \
                   helm template -n $namespace -f- $name $chart | \
-                  kubectl -n $namespace apply -f -
+                  kubectl -n $namespace $apply -f -
             }
 
+            [ -z "$namespace" ] && echo "namespace must be set" && exit 1
+            export_vars
             EOF
         '';
         copy-kubernetes-charts = ''
@@ -123,6 +127,8 @@ let
           else
             dest=\$1
           fi
+          [ -e $dest.bak ] && rm -rf $dest.bak
+          [ -e $dest ] && mv $dest $dest.bak
           echo "Copying charts into \$dest"
           cp -r ${kubernetes-charts}/share/kubernetes-charts \$dest
           chown -R \$USER \$dest
@@ -353,5 +359,6 @@ in {
   );
 
   imports = [ ./os.nix ];
+
 }