certificateDuration is not used for the Istio CSR generated certificate requests

[hari-vamsikrishna]

istio-csr generated certificates for the workloads is not using the "certificateDuration" parameter from the values.yaml.
The certificaterequests generated by the istio-csr are generated with "duration: 24h0m0s" instead of using the "certificateDuration" parameter from the values.yaml.

[JoshVanL]

Hi @hari-vamsikrishna, you can change the maximum requested duration using the istio-csr flag --max-client-certificate-duration=1h however is istio workloads request for shorter than that, then istio-csr will request that duration.

[hari-vamsikrishna]

Hi @JoshVanL,
Thank you for the super quick response 👍 .
Yes, i see the flag set as specified from the helm chart values.yaml --max-client-certificate-duration=720h
But, the scene is, Istio-csr (with AWS PCA integration) and istio is deployed in the eks cluster. I have deployed the httpbin from the https://raw.githubusercontent.com/istio/istio/1.11.7/samples/httpbin/httpbin.yaml. And, I see that there is no cert duration requested/configured from the workload.
I think these certificates are automatically requested by istio-csr for the istio mtls (certificate being used in memory by Envoy) when istio-injection is enabled to the namespace where this workload is deployed.
The problem is the certificate is renewed for every day, which is getting costly
So, how can we configure the certificate duration in this case?
ref: https://github.com/cert-manager/istio-csr/blob/v0.4.0/docs/getting_started.md

[volkorny]

Hi @hari-vamsikrishna,
Have you been able to find a solution to the issue?

[volkorny]

We solved limit of 24h by specifying SECRET_TTL