ng on each VM/bare-metal machine. It generates the private key and CSR (certificate signing request) locally, sends CSR to Istio CA for signing, and delivers the generated certificate together with the private key to Envoy.</p><h2 id="components">Components</h2><h3 id="identity">Identity</h3><p>Istio Auth uses <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Kubernetes service accounts</a> to identify who runs the service:</p><ul><li>A service account in Istio ha