title: How can I use custom client certificate for external service with istio?
body: <p>I need to setup mutual tls communication from kubernetes pod to external service. My system is running with istio system.</p>
  
  <p>I found reference about this.</p>
  
  <p><a href="https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/#TLSSettings" rel="nofollow noreferrer">https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/#TLSSettings</a></p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: DestinationRule
  metadata:
    name: external-mtls
  spec:
    host: *.external.com
    trafficPolicy:
      tls:
        mode: MUTUAL
        clientCertificate: /etc/certs/myclientcert.pem
        privateKey: /etc/certs/client_private_key.pem
        caCertificates: /etc/certs/rootcacerts.pem
  </code></pre>
  
  <p>According to this document, All I need to do is set mode MUTUAL (not ISTIO_MUTUAL) and set certificate files. As you can see, <strong>clientCertificate</strong>, <strong>privateKey</strong>, <strong>caCertificates</strong> is local file path.</p>
  
  <p>I think they should be in envoy proxy's disk. But I couldn't find a way to put my certificate files into envoy proxy's volume.</p>
  
  <p>How can I do that?</p>