Istio New Workload Identity Provision Pipeline Based on Envoy SDS
summary
Istio 1.1 replaces secret files with an Envoy-based pipeline: a node-agent uses Envoy SDS streamSecrets to fetch keys and certs, generates private keys on-node so keys never leave the host (node-agent generates keys on-node), and sends CSRs to a CA. It supports multiple CAs (Citadel, Vault, Google CA) and custom CA plugins (supports Citadel Vault Google CA). Demo with 5‑minute cert rotation shows zero proxy restarts and uninterrupted 200 responses.
AI-written summary · about
chapters (7)
- 0:00Start
- 9:20Identity provision Pipeline (before Istio 1.1)
- 9:32Envoy Secret Discovery Service(SDS)
- 11:22New identity provision pipeline
- 22:05Certification rotation
- 24:10Secure Istio Control Plane through SDS
- 26:57Plug your own CA
related talks
32mIstio: Sailing to a Secure Services Mesh
34mIstio Certificate Management Through Vault
37mZero Trust Workload Identity in Kubernetes
48mSecuring Kubernetes with Istio
19mIdentity, Istio, And You
15mIntegrating SPIRE and Istio
42mSecuring Kubernetes Workloads with Istio Service Mesh
01h 05mTutorial: Who Do You Think You Are? Driving the Need for Identity...