Istio Certificate Management Through Vault
Explore the design and implementation of a new Istio certificate management system using Vault in this 34-minute conference talk by Lei Tang and Yonggang Liu from Google. Dive into the Istio identity system, current certificate management architecture, and the new Vault-based system's authentication and authorization mechanisms. Follow a detailed example of a pod requesting and receiving a signed certificate from Vault. Learn about Istio's microservices management, security risks in service meshes, and context-aware access control. Witness demonstrations of authorization and authentication policies, certificate provision flow, and integration with external CAs. Gain insights into signing key injection, Citadel integration, and node agent integration, concluding with a prototype of Istio CA Vault integration.