quests/>Kubernetes CSR API</a>. Different workloads can get their certificates signed from different cert-signers. Each cert-signer is effectively a different CA. It is expected that workloads whose certificates are issued from the same cert-signer can talk mTLS to each other while workloads signed by different signers cannot.
This feature leverages <a href=/v1.18/blog/2019/dns-cert/>Chiron</a>, a lightweight component linked with Istiod that signs certificates using the Kubernetes CSR API.</p><p>For this e