Security in Istio is very comprehensive. The high-level overview starts with Citadel, which is a key and certificate manager. It acts as a Certificate Authority (CA) for Istio. An additional component, node_agent, needs to be enabled for certificate and key rotation. The node agent runs as a daemon set on all of the nodes to take care of the certificate and key rotations. The sidecar proxies implement a secure protocol communication between microservices, and this is a self-service model that is enabled through a parameter with no changes being made to the microservices. The following control plane components are used:
- Pilot: Pilot in Istio distributes authentication and provides secure naming conventions for sidecar proxies. Secure naming is a new concept that is gaining traction since it identifies services securely if they are part of the...