<p>I need to setup mutual tls communication from kubernetes pod to external service. My system is running with istio system.</p>

<p>I found reference about this.</p>

<p><a href="https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/#TLSSettings" rel="nofollow noreferrer">https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/#TLSSettings</a></p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: external-mtls
spec:
  host: *.external.com
  trafficPolicy:
    tls:
      mode: MUTUAL
      clientCertificate: /etc/certs/myclientcert.pem
      privateKey: /etc/certs/client_private_key.pem
      caCertificates: /etc/certs/rootcacerts.pem
</code></pre>

<p>According to this document, All I need to do is set mode MUTUAL (not ISTIO_MUTUAL) and set certificate files. As you can see, <strong>clientCertificate</strong>, <strong>privateKey</strong>, <strong>caCertificates</strong> is local file path.</p>

<p>I think they should be in envoy proxy's disk. But I couldn't find a way to put my certificate files into envoy proxy's volume.</p>

<p>How can I do that?</p>

<p>I found solution.</p>

<ol>
<li>create secret or config map</li>
</ol>

<pre><code>kubectl create secret generic my-cert --from-file=cert1.crt --from-file=cert2.crt
</code></pre>

<ol start="2">
<li>annotate pod or deployment with <strong>sidecar.istio.io/userVolumeMount</strong>, <strong>sidecar.istio.io/userVolume</strong></li>
</ol>

<pre><code>annotations:                                                                                       
  sidecar.istio.io/userVolumeMount: '[{"name":"my-cert", "mountPath":"/etc/my-cert", "readonly":true}]'
  sidecar.istio.io/userVolume: '[{"name":"my-cert", "secret":{"secretName":"my-cert"}}]'
</code></pre>

<p>Documentation on these and other annotations: <a href="https://preliminary.istio.io/docs/reference/config/annotations/" rel="noreferrer">https://preliminary.istio.io/docs/reference/config/annotations/</a></p>

<p>Done. It's mounted to envoy proxy pod.</p>
