he public key of the CA. This is encoded in the secret &ldquo;signer-ca-*&rdquo; in the signer-ca-system namespace.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl get secrets signer-ca-5hff5h74hm -o json
</code></pre></li></ol><p>The <code>tls.crt</code> field contains the base64 encoded public key file. Record this for future use.</p><h3 id=load-the-ca-root-certificate-into-a-secret-that-istiod-can-access>Load the CA root certificate into a secret that istiod can access</