Describe the feature request
Ability to override subjectAltNames for ISTIO_MUTUAL. Currently, subjectAltNames can be overriden for MUTUAL auth policy but not for ISTIO_MUTUAL. This results in skipped SAN verification for service entries (added for services running in remote istio cluster) which are not associated with istio service accounts in the local cluster.
Describe alternatives you've considered
None I can think of.
Additional context
We generate certificates with spiffee id with service identifier, we need a way to specify that in subjectAltNames while we use a different host in service entry that is actually called.
Describe the feature request
Ability to override subjectAltNames for ISTIO_MUTUAL. Currently, subjectAltNames can be overriden for MUTUAL auth policy but not for ISTIO_MUTUAL. This results in skipped SAN verification for service entries (added for services running in remote istio cluster) which are not associated with istio service accounts in the local cluster.
Describe alternatives you've considered
None I can think of.
Additional context
We generate certificates with spiffee id with service identifier, we need a way to specify that in subjectAltNames while we use a different host in service entry that is actually called.