#IstioCon Using ECC Workload Certificates (pilot-agent environmental variables) Jacob Delgado / Aspen Mesh #IstioCon ECC workload certificates ● In various environments, the need for x509 certificates cryptography (using ECDSA P-256) to use this feature ● Only ECDSA P-256 is supported #IstioCon pilot-agent environmental variables Disclaimer: Environmental variables and their use are considered experimental set the ECC_SIGNATURE_ALGORITHM environmental variable on sidecar ejection to ECDSA for use by pilot-agent ○ For gateways this environmental variable also must be set on installation/upgrade #IstioCon

./pilot/cmd/pilot-discovery go run ./pilot/cmd/pilot-agent #IstioCon Fully Local go run ./pilot/cmd/pilot-discovery go run ./pilot/cmd/pilot-agent + Fast! Bottleneck is go compilation time + Trivial Cluster Remote Istiod, local proxy go run ./pilot/cmd/pilot-agent #IstioCon Cluster Remote Istiod, local proxy go run ./pilot/cmd/pilot-agent + Rapid iteration - Very different from production environment

PILOT_SCOPE_GATEWAY_TO_NAMESPACE environment variable feature setting, which, if enabled, configures the pilot-agent such that “a gateway workload can only select gateway resources in the same namespace” and “Gateways applicable”;4 however, it is unclear how such a setting would be configured for the istio-ingressgateway pilot-agent and this would likely break standard Istio configurations from the Istio documentation which rely io/latest/docs/reference/config/networking/gateway/#Gateway 4https://istio.io/latest/docs/reference/commands/pilot-agent/ 11 | Google Istio Security Assessment Google / NCC Group Confidential func (ps *PushContext)

Istio Security Audit, 2023 tio/istio/blob/a7e57f 950edc9f06b29f977 d82fd8dfa9ae5f35b/ pilot/cmd/pilot-agent /status/server.go#L7 58 w.WriteHeader(http.StatusInternalServerError) } else { w.WriteHeader(http } https://github.com/is tio/istio/blob/a7e57f 950edc9f06b29f977 d82fd8dfa9ae5f35b/ pilot/cmd/pilot-agent /status/server.go#L4 99 if envoy != nil { envoy.Close() } if application != nil { application

istio-proxy container manifest lifecycle: postStart: exec: command: - pilot-agent - wait Fortunately, it is handled automatically since Istio 1.8 by setting the `holdAp