Service Mesh Root Cert Rotation: No Downtime, No Problem! - Zhonghu Xu, Huawei Cloud & Jianpeng He
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2024-03-28

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon North America in Salt Lake City from November 12 - 15, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Service Mesh Root Cert Rotation: No Downtime, No Problem! - Zhonghu Xu, Huawei Cloud & Jianpeng He, Tetrate

Root certificate rotation is an important security practice that helps ensure the integrity and trustworthiness of a public key infrastructure (PKI) or a certificate authority (CA). In the context of Service Mesh, periodically rotating root certs is particularly important to ensure the security of service-to-service communication, as each service identity is embedded in an x509 certificate. While Istio has long supported intermediate certificate rotation, replacing a new root certificate has historically been a complex task. In the past, it could require more than four rollouts for istiod and all workloads to complete the entire certificate rotation process. In this presentation, we will unveil a cutting-edge and improved method for conducting root certificate updates, sans the need for restarting any workloads or Istio components. Moreover, the process will not disrupt communication between workloads, ensuring seamless continuity.