restriction that a plugged in CA certificate must use ECC cryptography (using ECDSA P-256) to use this feature ● Only ECDSA P-256 is supported #IstioCon pilot-agent environmental variables Disclaimer: enable this, users must set the ECC_SIGNATURE_ALGORITHM environmental variable on sidecar ejection to ECDSA for use by pilot-agent ○ For gateways this environmental variable also must be set on installation/upgrade IstioOperator spec: meshConfig: defaultConfig: proxyMetadata: ECC_SIGNATURE_ALGORITHM: ECDSA #IstioCon helm ● values-overrides.yaml Install using helm install istiod manifests/charts/is