istio-csr

istio-csr is an agent that allows for Istio workload and control plane components to be secured using cert-manager.

Certificates facilitating mTLS — both inter and intra-cluster — will be signed, delivered and renewed using cert-manager issuers.

istio-csr supports Istio v1.10+ and cert-manager v1.3+

Documentation

Please follow the documentation at cert-manager.io for installing and using istio-csr.

Release Process

The release process is documented in RELEASE.md.

Inner workings

istio-csr has 3 main components: the TLS certificate obtainer, the gRPC server and the CA bundle distributor.

1. The TLS certificate obtainer is responsible for obtaining the TLS certificate for the gRPC server.

1. The gRPC server is responsible for receiving certificate signing requests from istiod and sending back the signed certificate.

1. The CA bundle distributor is responsible for creating and updating istio-ca-root-cert ConfigMaps in all namespaces (filtered using namespaceSelector).

Istio Ambient

When istio-csr is being deployed into Istio Ambient, the --ca-trusted-node-accounts flag must be set with the / of ztunnel, eg. istio-system/ztunnel. This allows ztunnel to authenticate using its own identity, then request certificates for the identity it will impersonate. For more information on how ztunnel handles certificate, see the Istio Ambient docs.