Service mesh

By default, Istio issues workload certificates for mTLS with its own certificate authority in istiod. To have certificates issued by an intermediate CA from Stronghold, use this chain:

1. The Stronghold PKI secrets engine holds the intermediate CA for the mesh and a role for issuing SPIFFE certificates.
2. cert-manager calls Stronghold through a vault Issuer, as described in cert-manager.
3. The istio-csr component of the cert-manager project accepts certificate requests from Istio proxies and issues them through cert-manager.

Goal

After the setup, Istio workload certificates for mTLS are issued by the intermediate CA in Stronghold instead of the built-in istiod CA.

Prerequisites

Before you start, prepare the following:

• The PKI secrets engine at the pki_int path with an intermediate CA, as in Internal PKI with Stronghold.
• cert-manager in the cluster and the Kubernetes auth method in Stronghold, configured as in cert-manager.
• Istio installed in the cluster, and permissions to change its installation parameters.
• A Stronghold token with permissions to write PKI roles and policies.

Step 1. Configure Stronghold

Create a PKI role for workload certificates and allow cert-manager to sign requests for it.

1. Create a PKI role that allows SPIFFE URI SANs used by Istio:

   d8 stronghold write pki_int/roles/istio-mesh allowed_uri_sans="spiffe://cluster.local/*" allow_any_name=true require_cn=false max_ttl=24h

   The role sets a short max_ttl: workload certificates are renewed automatically.

2. Create a policy that allows signing requests for this role:

   d8 stronghold policy write cert-manager-mesh - <<'POLICY'
   path "pki_int/sign/istio-mesh" {
     capabilities = ["create", "update"]
   }
   POLICY

3. Create a Kubernetes auth role with the cert-manager-mesh policy, as described in cert-manager. For a ClusterIssuer, the token audience in the role is vault://<CLUSTER_ISSUER_NAME>, in this example vault://stronghold-mesh.

Step 2. Configure cert-manager and Istio

Connect istio-csr to Stronghold through a ClusterIssuer and switch Istio to istio-csr.

1. Create a stronghold-mesh ClusterIssuer of type vault with path: pki_int/sign/istio-mesh.

2. Install istio-csr and set the stronghold-mesh ClusterIssuer in its parameters. Example istio-csr Helm chart values:

   app:
     certmanager:
       issuer:
         name: stronghold-mesh
         kind: ClusterIssuer
         group: cert-manager.io

3. Configure Istio to use istio-csr as its CA: set the istio-csr service address in global.caAddress and disable the built-in istiod CA (ENABLE_CA_SERVER=false).

Proxies must trust the root certificate of the chain. It is the root-ca.pem file from Internal PKI with Stronghold. If the root CA is in the pki_root mount, read it from Stronghold:

d8 stronghold read -field=certificate pki_root/cert/ca

Verification

Check the result:

1. Check that the ClusterIssuer is ready:

   d8 k get clusterissuer stronghold-mesh

   The READY column must show True.

2. Check that Stronghold issues certificates for the mesh. The list of serial numbers in pki_int must grow as workloads start:

   d8 stronghold list pki_int/certs

Cleanup

Before you remove the integration, switch Istio back to the built-in istiod CA and remove istio-csr. Then delete the ClusterIssuer and the Stronghold objects:

d8 k delete clusterissuer stronghold-mesh
d8 stronghold delete pki_int/roles/istio-mesh
d8 stronghold policy delete cert-manager-mesh

Also delete the Kubernetes auth role created in step 1.

Additional resources

• PKI secrets engine
• cert-manager
• Internal PKI with Stronghold
• Kubernetes auth method