/p></li><li><p>Rotate keys and certificates periodically</p></li><li><p>Revoke a specific key and certificate pair when necessary</p></li></ul><p>For services running on VM/bare-metal machines, the above four operations are performed by Istio CA together with node agents.</p><h2 id="workflow">Workflow</h2><p>The Istio Auth workflow consists of two phases, deployment and runtime. For the deployment phase, we discuss the two scenarios (i.e., in Kubernetes and VM/bare-metal machines) separately since they are 