istio-csr Architecture

istio-csr Architecture An architecture diagram generated by Archify. Application · app container · Workload Pod Application app container Envoy Sidecar · workload proxy · Workload Pod Envoy Sidecar workload proxy istio-csr · gRPC CA server · istio-csr istio-csr gRPC CA server cert-manager Controller · Processes approved requests · cert-manager cert-manager Controller Processes approved requests CertificateRequest · cert-manager.io/v1 · cert-manager CertificateRequest cert-manager.io/v1 ClusterIssuer · istio-ca · Issuer ClusterIssuer istio-ca External PKI · CA / Vault PKI / AWS PCA · Issuer External PKI CA / Vault PKI / AWS PCA SVID Certificate · spiffe://cluster.local/ns/.../sa/... · Architecture component SVID Certificate spiffe://cluster.local/ns/.../sa/... istio-agent · CSR · SDS · Workload Pod istio-agent CSR · SDS Peer Envoy · Another workload Pod · Peer workload Peer Envoy Another workload Pod 1. CSR · workload identity 2. Create via Kubernetes API watch / reconcile 3. issuerRef · approval sign 4. X.509-SVID 5. Return certificate chain 6. gRPC response SDS: key + certificate local app hop mTLS between workload proxies Workload Pod istio-csr cert-manager Issuer Peer workload Legend Backend Cloud Security External

Trust and renewal

  • • Mount/pin the istio-csr serving trust root
  • • Separate CA rollover from workload renewal

Configuration scope

  • • Sidecar flow; verify Ambient support separately
  • • External private-CA issuers use their own issuerRef group/kind