Hi,

We want to be able to rotate Envoy certs/keys without having to restart the Envoy. We're particularly interested in the client cert/key for connecting to upstream clusters. We recognize the CDS allows us to dynamically change clusters, but that doesn't let us rotate the cert used to connect to the CDS itself.

We see prior discussion about supporting cert rotation (#891) which was answered by pointing people towards the in-development LDS (#315). However, we don't see how the LDS solves the problem of rotating certs used to connect to the CDS.

What work would be required for support cert/key rotation for CDS without having to restart Envoy? This issue is a blocker for us using Envoy (we're looking at integrating it, and perhaps Istio, into Cloud Foundry).

We might be able to contribute the feature, if we had some guidance.

Cheers,
Angela and @rosenhouse