--- title: istio.v1.auth layout: protoc-gen-docs generator: protoc-gen-docs number_of_entries: 4 ---

Services

IstioCAService

Service definition of IstioCAService that can dynamically verify the CSR for service identities for Istio services running on various platforms and approve or disapprove the request after verifying the Node Agent credentials provided as a part of the Request.

rpc HandleCSR(CsrRequest) returns (CsrResponse)

A request object includes a PEM-encoded certificate signing request that is generated on the Node Agent. Additionally credential can be attached within the request object for a server to authenticate the originating node agent.

Types

CsrRequest

Field Type Description
csrPem bytes

PEM-encoded certificate signing request

nodeAgentCredential bytes

opaque credential for node agent

credentialType string

type of the nodeagentcredential (aws/gcp/onprem/custom…)

requestedTtlMinutes int32

the requested ttl of the certificate in minutes

CsrResponse

Field Type Description
isApproved bool

Whether the CSR is approved.

status google.rpc.Status
signedCert bytes

The signed target cert.

certChain bytes

The cert chain up to the trusted root cert. It includes all the certs between the newly signed cert and the root cert.

google.rpc.Status

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. The error model is designed to be:

Overview

The Status message contains three pieces of data: error code, error message, and error details. The error code should be an enum value of google.rpc.Code, but it may accept additional error codes if needed. The error message should be a developer-facing English message that helps developers understand and resolve the error. If a localized user-facing error message is needed, put the localized message in the error details or localize it in the client. The optional error details may contain arbitrary information about the error. There is a predefined set of error detail types in the package google.rpc that can be used for common error conditions.

Language mapping

The Status message is the logical representation of the error model, but it is not necessarily the actual wire format. When the Status message is exposed in different client libraries and different wire protocols, it can be mapped differently. For example, it will likely be mapped to some exceptions in Java, but more likely mapped to some error codes in C.

Other uses

The error model and the Status message can be used in a variety of environments, either with or without APIs, to provide a consistent developer experience across different environments.

Example uses of this error model include:

Field Type Description
code int32

The status code, which should be an enum value of google.rpc.Code.

message string

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.

details google.protobuf.Any[]

A list of messages that carry the error details. There is a common set of message types for APIs to use.