DNS Certificate Management

Por Lei Tang (Google) | 14 de janeiro de 2019

By default, Citadel manages the DNS certificates of the Istio control plane. Citadel is a large component that maintains its own private signing key, and acts as a Certificate Authority (CA).

New in Istio 1.4, we introduce a feature to securely provision and manage DNS certificates signed by the Kubernetes CA, which has the following advantages.

Lighter weight DNS certificate management with no dependency on Citadel.
Unlike Citadel, this feature doesn’t maintain a private signing key, which enhances security.
Simplified root certificate distribution to TLS clients. Clients no longer need to wait for Citadel to generate and distribute its CA certificate.

The following diagram shows the architecture of provisioning and managing DNS certificates in Istio. Chiron is the component provisioning and managing DNS certificates in Istio.

To try this new feature, refer to the DNS certificate management task.

Veja também

Secure Webhook Management

A more secure way to manage Istio webhooks.

Plugging in External CA Key and Certificate

Shows how operators can configure Citadel with existing root certificate, signing certificate and key.

Introducing the Istio v1beta1 Authorization Policy

Introduction, motivation and design principles for the Istio v1beta1 Authorization Policy.

Multi-Mesh Deployments for Isolation and Boundary Protection

Deploy environments that require isolation into separate meshes and enable inter-mesh communication by mesh federation.

App Identity and Access Adapter

Using Istio to secure multi-cloud Kubernetes applications with zero code changes.

Change in Secret Discovery Service in Istio 1.3

Taking advantage of Kubernetes trustworthy JWTs to issue certificates for workload instances more securely.

Esta informação foi útil?

Você tem alguma sugestão de melhoria?

Obrigado pelo seu feedback!