bare-metal machines. We use different key provisioning mechanisms for each scenario.</p><p>For services running on Kubernetes pods, the per-cluster Istio CA (Certificate Authority) automates the key &amp; certificate management process. It mainly performs four critical operations :</p><ul><li><p>Generate a <a href="https://spiffe.github.io/docs/svid">SPIFFE</a> key and certificate pair for each service account</p></li><li><p>Distribute a key and certificate pair to each pod according to the service account<