Does Istio support storing TLS certificates in an external secrets management system like Hashicorp Vault?

[calster6]

We know that Istio can read TLS certificates from a file and automatically read new TLS certificates using SDS + k8s secrets within istio namespace.

However, does Istio support storing TLS certificates within a secret management store like Hashicorp Vault?

We have already successfully integrated the storage of the Istio root CA using this documentation: https://tetrate.io/blog/how-to-use-hashicorp-vault-as-a-more-secure-way-to-store-istio-certificates/

I appreciate the help and support! Cheers

[rootsongjc]

I think so. As you see in the referred blog, do you have further questions?

[calster6]

In the referred blog, storing an external root CA is possible because there is an environment variable for it:

"In order to instruct Istio to pick up our certificates elsewhere compared to the standard kubernetes secrets, we will leverage an environment variable (documented here) for istio-pilot (aka istiod or the Istio control plane), so certificates will be picked up from an alternative location within the Kubernetes Pod. This is needed because the vault-agent-init injection container will create a new mounted volume /vault/secrets to drop the certificates and private key we instrument it to pull from the external vault server."

Variable Name Type Default Value Description
ROOT_CA_DIR String /etc/cacerts Location of a local or mounted CA root

In the pilot-agent documentation I do not see a similar Env variable for TLS certificates: https://istio.io/latest/docs/reference/commands/pilot-agent/#envvars