Istio Certificate Management Through Vault

on YouTube ↗34m

" summary

Describes a concrete Istio certificate flow that replaces Citadel’s internal CA by delegating signing to Vault: a per-node node agent exposes the SDS API, pods send CSRs over a UDS to the agent which forwards the Kubernetes service account identity to Citadel, Citadel authenticates/authorizes then forwards the CSR to Vault signing, Vault returns the signed cert, and the agent hot-delivers keys to Envoy. Covers three integration modes: signing-key injection, Citadel→external CA adapter, and direct node-agent→external CA.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to Istio
2. 1:26Control and Data Plane
3. 3:16Security Fundamentals
4. 7:10Context-Aware Access Control
5. 10:40Security Demo
6. 16:47Certificate Management
7. 20:58External CA Integration
8. 23:39Vault Integration Flow
9. 27:31Vault Integration Demo
10. 29:28Q&A and Future Plans

" related talks

• 30mIstio New Workload Identity Provision Pipeline Based on Envoy SDSQuanjie Lin, Diem Vu · KubeCon + CloudNativeCon Europe 2019
• 48mSecuring Kubernetes with IstioErlend Oftedal · NDC Security Oslo 2019
• 34mEnvoy SDS: Fortifying Istio SecurityYonggang Liu, Quanjie Lin · KubeCon + CloudNativeCon Europe 2019
• 45mSecure Together: Consul + VaultRosemary Wang · HashiConf Europe 2022
• 19mIdentity, Istio, And YouJackie Elliott · Istio Day North America 2023
• 23mVault for Secrets Management and TLS in Consul K8sDavid Yu, Kyle Schochenmaier · HashiConf Global 2021
• 32mIstio: Sailing to a Secure Services MeshSpike Curtis, Dan Berg · KubeCon + CloudNativeCon North America 2017
• 58mConsul + Vault Learn Lab: Consul API GatewayEddie Rowe, Daniele Carcasole · HashiConf Europe 2022