different. Once the key and certificate are deployed, the runtime phase is the same for the two scenarios. We briefly cover the workflow in this section.</p><h3 id="deployment-phase-kubernetes-scenario">Deployment phase (Kubernetes Scenario)</h3><ol><li><p>Istio CA watches Kubernetes API Server, creates a <a href="https://spiffe.github.io/docs/svid">SPIFFE</a> key and certificate pair for each of the existing and new service accounts, and sends them to API Server.</p></li><li><p>When a pod is created, API S