What would you like to be added
Few options:
- expose the Istio CA gRPC interface, using the K8S JWT with istio-ca audience.
- add an option to change the mount path for certs to the well-known path where istio-agent is looking for certs
Also it would be nice if the certs included the spiffe identity ( using a trust domain configured at install time),
and maybe an option to restrict the DNS names to NAME.NAMESPACE.SUFFIX - where the suffix is specified at install
time, namespace is the pod namespace - and name may be the only thing customized by the user (can default
the the service account name for example).
Why this is needed
- Good to have options - Istio does have an integration with CertManager and I know autocert has a signer for cert manager, but more direct integration is providing more choices for users.
- current mechanism of arbitrary names is fine for users with OPA or strict access, but a more strict naming would work for
everyone else.
What would you like to be added
Few options:
Also it would be nice if the certs included the spiffe identity ( using a trust domain configured at install time),
and maybe an option to restrict the DNS names to NAME.NAMESPACE.SUFFIX - where the suffix is specified at install
time, namespace is the pod namespace - and name may be the only thing customized by the user (can default
the the service account name for example).
Why this is needed
everyone else.