Installation into existing istio cluster

[cert-manager]

Installation into existing istio cluster

[NickAJScott]

Great thanks for the detailed update. I have actually moved away from the GKE addon version of istio and am manually installing istio using istio operator after the cluster is created, so installing istio-csr before i do that step will work fine for me now. Thanks for the help!

[JoshVanL]

Hi @NickScottKortical, currently the recommended method of installation is always to install istio after istio-csr. The reason for this is that it will require a CA migration from the one which is created on boot, over to the istio-csr one. This is a tricky process to get right and is not fully supported by istio in an automated way https://blog.christianposta.com/diving-into-istio-1-6-certificate-rotation/. There is some work going on upstream to automate this process which should land in 2021 https://docs.google.com/spreadsheets/d/1FJ3AJFFnGw6TxZAoyj-zgFwTn37WsMKTOGNR4FjG7T8/edit#gid=117171340

If you are not worried about down time if the cluster has just been made, then it would be fine to install istio-csr, change the istio configuration, remove the selfsigned CA secrets from istio-system, and reboot all istio controlplane/workloads.

[JoshVanL]

No problem! I'll close the issue out but please feel free to reopen if needed.

/close

[jetstack-bot]

@JoshVanL: Closing this issue.

In response to this:

No problem! I'll close the issue out but please feel free to reopen if needed.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.