-* By default, `istiod` will create a ConfigMap `istio-ca-root-cert` in every namespace it watches, which can create unnecessary ConfigMaps. This behavior depends on the discoverySelectors, so that any proxy that might be injected in those namespaces has istiod's CA root certificate. This is needed for the proxies to verify the istiod's certificate when performing the initial connection. No 'normal' sidecar injections are planned. The only injection necessary is Gateway injection based on k8s Gateway API resources. This issue was fixed for Red Hat OpenShift Service Mesh 3.0.1. However, istiod does not clean up existing ConfigMaps. (link:https://issues.redhat.com/browse/OSSM-9076[OSSM-9076])
0 commit comments