LANGUAGES Signal 147
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles
↗
Kubernetes v1.37 promotes Pod Certificates and Cluster Trust Bundles to GA, adding built-in X.509 certificate issuance for TLS and mTLS to core Kubernetes as a proof-of-possession alternative to bearer-token service account JWTs.
Service account JWTs are bearer tokens: anyone who obtains a copy can impersonate the identity, and you necessarily hand copies to peers during authentication. Pod Certificates use asymmetric cryptography where the private key never leaves the workload, eliminating that impersonation risk. This gives workloads a production identity mechanism comparable in ease to service account JWTs but with stronger security properties.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Pod Certificates use X.509 certificates with proof-of-possession rather than bearer tokens, so the private key never leaves the workload.
The feature has a pluggable interface in Kubelet, allowing multiple certificate types to be issued within a single cluster simultaneously.
Two built-in certificate providers are planned: one for server TLS certificates for Kubernetes service DNS names and one for SPIFFE client certificates.
THE CLUSTER