CSR's when plugging in an existing CA into Istio - istio

Question

I'm looking at "plugging in an existing CA" into my Istio environment as documented here:
https://istio.io/pt-br/docs/tasks/security/citadel-config/plugin-ca-cert/
I can see that the following command allows you to store a key, cert & chain to Kubernetes secrets, however it does not appear to provide an option for creating a CSR. Obviously, this would also involve first generating a private key.
Is this correct, or is there an option to do this?
$ kubectl create secret generic cacerts -n istio-system --from-file=samples/certs/ca-cert.pem \
--from-file=samples/certs/ca-key.pem --from-file=samples/certs/root-cert.pem \
--from-file=samples/certs/cert-chain.pem

Answer 1

The command You listed allows You to create a secret object in kubernetes for the CA certificate, key, chain etc. Which can be consumed by deployments and services for use. So assumption in documentation is that You already have a certificate ready for use.
I suggest following entire istio SDS secure gateway configuration guide.
To generate a private key and CSR using OpenSSL follow istio documentation guide:
For this task you can use your favorite tool to generate certificates and keys. The commands below use openssl
Create a root certificate and private key to sign the certificates for your services:
$ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=example Inc./CN=example.com' -keyout example.com.key -out example.com.crt
Create a certificate and a private key for httpbin.example.com:
$ openssl req -out httpbin.example.com.csr -newkey rsa:2048 -nodes -keyout httpbin.example.com.key -subj "/CN=httpbin.example.com/O=httpbin organization"
$ openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in httpbin.example.com.csr -out httpbin.example.com.crt
Additional information from istio documentation:
https://istio.io/docs/concepts/security/#pki
Hope it helps.