March 2020
Intermediate to advanced
626 pages
14h 45m
English
Previously, we mentioned that there is no automation for rotating certificates and keys for virtual services and suggested to use a step-ca tool instead. The aforementioned case was for the external service connecting to the edge microservice through the Ingress gateway. Istio is not designed to automate external services. However, Citadel and node agent are designed to automatically rotate/renew certificates and keys based on the TTL of the existing certificate, and this process is fully automatic.
In Citadel, certificate rotation is set to an interval of 90 days. The rotation window can be changed by modifying the istio-citadel container argument from 2,160 hours to, say, 48 hours. ...
Read now
Unlock full access