Istio mTLS Communication and Certificate Issuance

Istio mTLS Communication and Certificate Issuance An architecture diagram generated by Archify. Application · App container · Pod A Application App container Envoy Proxy · Sidecar · Pod A Envoy Proxy Sidecar istiod · Certificate issuance · Architecture component · CA istiod Certificate issuance CA Envoy Proxy · Sidecar · Pod B Envoy Proxy Sidecar Application · App container · Pod B Application App container Plaintext mTLS encrypted (both ways) Plaintext Certificate Certificate Pod A Pod B Legend Application container Istio control plane Envoy sidecar (mTLS termination)

Identity provisioning

  • • Istio Agent sends a CSR to istiod
  • • istiod issues an X.509 certificate based on the SPIFFE ID
  • • Agent delivers the certificate to Envoy over the SDS protocol
  • • Automatic certificate renewal (default TTL: 24 hours)

Traffic path

  • • Application-to-sidecar traffic is local plaintext inside the pod
  • • Traffic between Envoy sidecars is automatically encrypted and authenticated with mTLS
  • • SPIFFE ID: spiffe://cluster.local/ns/<ns>/sa/<sa>