Configure Citadel Service Account Secret Generation

To complete this task, you should first take the following actions:

• Read the security concept.

• Follow the to install Istio with mutual TLS enabled.

To create a new sample namespace foo, run:

$ kubectl get secrets -n foo | grep istio.io
NAME                    TYPE                           DATA      AGE

To label the namespace to prevent Citadel from creating ServiceAccount secrets in target namespace foo, run:

$ kubectl label ns foo ca.istio.io/override=false

To create a new ServiceAccount in this namespace, run:

To check the namespace’s secrets again, run:

$ kubectl get secrets -n foo | grep istio.io
NAME                    TYPE                           DATA      AGE

You can observe that no new istio.io/key-and-cert secret was generated for the sample-service-account service account.

Opt-in service account secret generation

...
security:
    enableNamespacesByDefault: false
...

Once this mesh configuration is applied, to create a namespace foo and check the secrets present in that namespace, run:

You can observe that no secrets have been created. To override this value for the foo namespace, add a ca.istio.io/override=true label in that namespace:

To create a new service account in the foo namespace, run:

$ kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sample-service-account
  namespace: foo
EOF

To check the secrets in the foo namespace again, run:

Cleanup

To delete the test namespace and all its resources, run:

$ kubectl delete ns foo