Istiod's cacert.pem is under testdata/

[myidpt]

Bug description
The file tests/testdata/certs/cacert.pem is used by Istiod for JWKS endpoint authenticaiton:
https://github.com/istio/istio/blob/master/tools/istio-docker.mk#L102
https://github.com/istio/istio/blob/master/pilot/pkg/model/jwks_resolver.go#L77

[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Expected behavior
We can use the Linux OS root cert pool, i.e., /etc/ssl/certs/ca-certificates.crt.
https://github.com/istio/istio/blob/master/docker/Dockerfile.base#L28
will update the pool when building the image.

Steps to reproduce the bug

Version (include the output of istioctl version --remote and kubectl version --short and helm version if you used Helm)
All versions.

How was Istio installed?

Environment where bug was observed (cloud vendor, OS, etc)
All

[howardjohn]

Why is this better than /etc/ssl/certs/ca-certificates.crt? /etc/ssl/certs/ca-certificates.crt is updated for us, /cacert.pem is certainly outdated.

[xulingqing]

@myidpt Hi Oliver, what's your suggestion?

One thing for implementation is on mac it do not have /etc/ssl/certs/ca-certificates.crt
I'm working on trying to install with pilot docker file and I will give you update shortly. Thanks!

[howardjohn]

The dockerfile already has /etc/ssl/certs/ca-certificates.crt. We should probably just use x509.SystemCertPool() anyways though, which indirectly reads that and a few other locations?

[yangminzhu]

Why is this better than /etc/ssl/certs/ca-certificates.crt? /etc/ssl/certs/ca-certificates.crt is updated for us, /cacert.pem is certainly outdated.

+1, we should fix the outdated problem.

@xulingqing I also checked the pilot image and it already has the certificate, so all you need to do is: 1) change to use x509.SystemCertPool() in jwks_resolver.go; 2) Remove the cacerts.pem from the docker image; 3) Test it a little bit to make sure it works (can use curl for a quick test)

[myidpt]

Sure, I'm OK with using the system root cert pool. Checked the code and found this:
https://github.com/istio/istio/blob/master/docker/Dockerfile.base#L28
This will update the system root cert pool when building the image.