Use Aspen Mesh Certificates for Non-Mesh Application

This page describes how applications can use Aspen Mesh managed certificates & keys without injecting the sidecar proxy.

Note

These instructions are only applicable when SDS mode is DISABLED.

Background

When the Aspen Mesh Citadel component notices a service account in a namespace, it will automatically generate a secret that contains the TLS key and certificate corresponding to that service account. Additionally, Citadel automatically rotates these credentials based on configurable expiry periods. Applications that are not in the mesh i.e. don’t have a sidecar proxy can consume these Kubernetes secrets using the Kubernetes API. This enables users to leverage a common certificate management infrastructure like Citadel to manage the lifecycle of certificates for application both in and out of the mesh.

Note

It is the application’s responsibility to watch for changes of the certificate files as Aspen Mesh Citadel rotates them, re-uploads and uses them.

Setup

In SDS disabled mode, to mount the Aspen Mesh certificates, add /etc/certs volume to the pod definition:

volumeMounts:
  - name: istio-certs
    mountPath: /etc/certs 

In the spec, add volume for the certificates

volumes:
  - name: istio-certs
    secret:
      defaultMode: 420
      optional: true
      secretName: istio.<ServiceAccountName>

Example

apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin-service-account
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin-service
  labels:
    app: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: httpbin
    spec:
      serviceAccountName: httpbin-service-account
      containers:
      - image: docker.io/kennethreitz/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 80
        volumeMounts:
          - name: istio-certs
            mountPath: /etc/certs
      volumes:
        - name: istio-certs
          secret:
            defaultMode: 420
            optional: true
            secretName: istio.httpbin-service-account

Verification

• Verify that the secret istio.httpbin-service-account exists.

• Login to the pod console, verify that /etc/certs directory exists and there are certificates under it.

Run the command:

kubectl exec -n <pod-namespace> $(kc get pod -n <pod-namespace> -l app=httpbin -o jsonpath='{.items[0].metadata.name}') -- ls  /etc/certs

Verify the following certificate files:

cert-chain.pem
key.pem
root-cert.pem