Rotating certificates in Istio

In this livestream, we'll look at certificates in Istio. We'll talk about how to plugin your own CA certificates, rotate them without downtime, and show how to use cert-manager and istio-csr to issue workload certificates.

[@ChristianAltamiranoAyala]

isn't istio operator deprecated? so how to install istio with external CA without using istio operator?

[@learncloudnative]

The use of Istio operator pod (i.e. istioctl operator init) is discouraged. However, the IstioOperator API (and the resource) is all good. So doing istioctl operator init and using kubectl to apply the IstioOperator resource is discouraged, however, doing istioctl install -f or just Helm is the recommended way to install Istio.

[@user-tl6xo1uq4m]

How about rotating root certificate with cert-manager?

[@learncloudnative]

The idea is to use the intermediate certificates and not the root cert directly. You can configure cert-manager to manage and handle cacerts and then have istiod automatically reload them.

[@sarathreddy2356]

Can you please share the github repo?

[@learncloudnative]

The github repo for all episodes is here: github.com/solo-io/hoot

[@sarathreddy2356]

Thank you@@learncloudnative