Service Mesh Root Cert Rotation: No Downtime, No Problem!
summary
Claims a zero-downtime root CA rotation for Istio that avoids restarting workloads or istiod by using two feature gates: ProConfig XDS agent and allowing istiod to push CA changes to the agent. Workflow uses a staged “combined-root A+B” update then swap to B, cutting the long multi-rollout, hours-long process down to a ~30 minute initial reload, a ~1 minute intermediate swap, and a final 1–2 minute cutover. Works with istiod/XDS, supports SPIRE or self-signed signing modes, and preserves east‑west traffic during rotation.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:02Certificate rotation workflows
- 3:13Workload communication
- 6:06Self-signed workload certs in Istio
- 9:01Root cert rotation challenges before 1.20
- 11:12Root cert rotation scenarios
- 13:21Auto-reload feature for root CA
- 15:29Step-by-step rotation process
- 18:26References
- 19:28Q&A
related talks
13mBOSH & SSL Certificates - Rotating Certificates Smoothly
19mIdentity, Istio, And You
21mIteratively Implementing Istio: Zero to Service Mesh with No Downtime
26mShh, It is A Secret: Manage Your Workload Certs in Service Mesh without Persisting any Secrets- Lin Sun, Solo.io
30mIstio New Workload Identity Provision Pipeline Based on Envoy SDS
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
43mService Mesh for developers
26mService Mesh Journey - Building Security and Reliability One Si...