Must I set a dedicate ca cluster?

[gyliu513]

@rshriram I found that at https://github.com/rshriram/istio_federation_demo/blob/master/run_demo_from_laptop.sh#L123-L125 , we actually created three clusters including ca cluster, cluster1 and cluster2, so must I create three clusters if want to do such demo?

[rshriram]

Yes, the idea being that the root CA is running outside both clusters, and automatically rotating certs of the cluster-level CAs. You can tweak the istio CA setup to remove the root CA and use static root certs, but its not secure in the long run.

[gyliu513]

Got it, thanks @rshriram

As your tutorial was based on aws, I was working on private cloud which is based on local kubernetes cluster, will post a blog once it is ready.

[gyliu513]

@rshriram I think that the current Isito do not support automatically rotating certs at cluster level, does istio have plan to support this?