Identity, Istio, And You
summary
Compares four practical identity paths for Istio with concrete tradeoffs: self-signed Istio CA gives immediate mTLS by generating a root stored as the istiod secret but places the root private key on-cluster; supplying a cacerts secret lets Istio act as an intermediate so the root key stays off-cluster; using a kubernetes CSR with cert-manager enables per-namespace or per-proxy signers for multi-tenancy but adds experimental complexity; SPIRE attestation replaces Kubernetes-only verification, supports multi-cluster federation and richer workload attestation at higher operational cost.
AI-written summary · about
chapters (10)
- 0:00Istio identity solutions intro
- 1:05Identity in service meshes
- 2:30Istio identity categories
- 3:36Key terms for cert requests
- 4:39Istio as default CA
- 6:25Custom CA with Istio
- 9:15Kubernetes CSR API
- 12:48Istio CSR with cert-manager
- 14:53Spire for workload identity
- 18:08Comparing identity solutions
related talks
01h 05mTutorial: Who Do You Think You Are? Driving the Need for Identity...
32mIstio: Sailing to a Secure Services Mesh
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
28mService Identity - The Key to Zero Trust with Service Mesh
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
26mShh, It is A Secret: Manage Your Workload Certs in Service Mesh without Persisting any Secrets- Lin Sun, Solo.io
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars