Feature request: istio-ca-root-cert to use secret instead of configmap

[cert-manager]

Feature request: istio-ca-root-cert to use secret instead of configmap

[xunholy]

@c0ffeec0der CAs are public, why do you want it to be a secret?

[c0ffeec0der]

@xunholy

Correct it is public. However, the nature of configmap as described in https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/

is to decouple configuration

where secret as described in https://kubernetes.io/docs/concepts/configuration/secret/

is to store sensitive data

given than CA is more to data rather than config. It's better to store as secret, and it will be uniform with cert-manager which store cert as secret

[JoshVanL]

Storing the CA in a config-map is a constraint set by istio. This matches the behavior of Kubernetes itself which stores the API server CA in the ConfigMap kube-root-ca.crt in every namespace.

Since there is nothing istio-csr can do about this I will close the issue. If this changes in future we can re-visit.

/close

[jetstack-bot]

@JoshVanL: Closing this issue.

In response to this:

Storing the CA in a config-map is a constraint set by istio. This matches the behavior of Kubernetes itself which stores the API server CA in the ConfigMap kube-root-ca.crt in every namespace.

Since there is nothing istio-csr can do about this I will close the issue. If this changes in future we can re-visit.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.