istio-csr is an agent that integrates Istio with cert-manager to secure workload and control plane components using certificate-based mutual TLS.
The tool solves the problem of managing certificates for Istio's mTLS communication across and within clusters. It works by intercepting certificate signing requests from Istio's control plane component (istiod) and delegating their signing to cert-manager's issuer system. The agent comprises three main components: a TLS certificate obtainer that provisions the agent's own server certificate via cert-manager's CertificateRequest API, a gRPC server that receives and responds to signing requests from istiod, and a CA bundle distributor that maintains root certificate ConfigMaps across namespaces using namespace selectors. This architecture allows organizations to use their existing cert-manager infrastructure and issuers to manage Istio's certificate lifecycle rather than relying on Istio's built-in CA.
Teams should adopt this tool if they already operate cert-manager and want unified certificate management across their Istio deployment. It suits clusters where cert-manager issuers are the source of truth for certificate provisioning, or where organizations need to integrate Istio certificates with external PKI systems that cert-manager can reach. The tool supports Istio v1.10 and later alongside cert-manager v1.3 and later. For Istio Ambient deployments, the ztunnel service account must be explicitly trusted via the ca-trusted-node-accounts flag to allow ztunnel to authenticate and request certificates for workload identities it will impersonate.
Development activity shows consistent engagement with the project's core responsibilities. The team maintains active documentation integration with the cert-manager website rather than relying solely on the repository README. A formal release process is documented and followed. The project explicitly addresses emerging Istio features, as evidenced by dedicated support for Istio Ambient mode including specific configuration guidance for ztunnel integration.
