Watch and track your favorite playlist.
Curated by: CNCF [Cloud Native Computing Foundation] (43 videos)
Cert-manager有助于增强Istio证书管理的安全性和灵活性。| Cert-Manager Help Enhance Security and Flexibility of Istio Certificate Management - Chaomeng Zhang, Huawei 对等身份验证是 Istio 零信任安全模型的基本组成部分。默认情况下，Istio 创建私钥和自签名根证书，使用它们自动签署和颁发 X.509 证书给每个工作负载，并帮助应用程序实现互相 TLS，以实现无需更改代码的安全服务间通信。在生产环境中，强烈建议从 PKI 提供商颁发根 CA，以增强安全性并提供更多的灵活性。在这次演讲中，超盟将分享 cert-manager 的详细实践，它是一个强大且可扩展的 X.509 证书控制器，如何帮助 Istio 构建增强的零信任网络。演讲将说明 cert-manager 如何通过自动从指定的 PKI 提供商获取证书，并在到期前的配置时间内更新证书，以避免任何服务停机，从而简化 Istio 根 CA 的生命周期管理。 Peer authentication is fundamental part of Istio’s zero-trust security model. By default, Istio creates a private key and self-signed root certificate, uses them to automatically sign and issue X.509 certificates to every workload, and help application make mutual TLS to secure service-to-service communication without code changes. In production environment, it is strongly recommended to issue the root CA from a PKI provider to enhance the security and provide more flexibility. In this speech, Chaomeng will share a detailed practice of how cert-manager, a powerful and extensible X.509 certificate controller, help Istio build enhanced zero-trust network. That is how cert-manager simplify Istio root CA lifecycle management by automatically obtaining certificates from a specified PKI provider, and renewing certificates at a configured time before expiry to avoid any service downtime.