istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Faq (#1997)

This commit is contained in:
Tao Li 2018-07-26 16:57:13 -07:00 committed by Martin Taillefer
parent e38daefcc7
commit ff2870e25c
2 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
content/help/faq/security/k8s-health-checks.md
View File

@ -1,14 +1,14 @@
---
title: How can I use Kubernetes liveness and readiness for service health check with Istio Auth enabled?
title: How can I use Kubernetes liveness and readiness for service health check when mutual TLS is enabled?
weight: 50
---
If Istio Auth is enabled, http and tcp health check from kubelet will not
work since they do not have Istio Auth issued certs. A workaround is to
If mutual TLS is enabled, http and tcp health checks from the kubelet will not
work since they do not have Istio-issued certs. A workaround is to
use a [liveness command](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#define-a-liveness-command)
for health check, e.g., one can install curl in the service pod and curl itself
for health checks, e.g., one can install `curl` in the service pod and `curl` itself
within the pod. The Istio team is actively working on a solution.
An example of readinessProbe:
An example of a readiness probe:
{{< text yaml >}}
livenessProbe:

4
content/help/faq/security/use-k8s-secrets.md
View File

@ -1,9 +1,9 @@
---
title: Does Istio Auth use Kubernetes secrets?
title: Does Istio authentication use Kubernetes secrets?
weight: 120
---
Yes. The key and certificate distribution in Istio Auth is based on [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/).
Yes. The key and certificate distribution in Istio Authentication is based on [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/).
Secrets have known [security risks](https://kubernetes.io/docs/concepts/configuration/secret/#risks). The Kubernetes team is working on
[several features](https://docs.google.com/document/d/1T2y-9geg9EfHHtCDYTXptCa-F4kQ0RyiH-c_M1SyD0s) to improve