TLDR Tech / DevOps
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles
Kubernetes 1.37 brings Pod Certificates and Cluster Trust Bundles to general availability, adding X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. The feature is designed as an alternative to service account JWTs, which are bearer tokens, meaning anyone who receives a copy of the token can use it to impersonate the workload. Pod Certificates use proof-of-possession credentials, so a workload proves it holds a private key without ever sending that key to a peer. The Kubernetes project has also released Tinycert, a third-party signer for experimenting with Pod Certificates, since no built-in signers ship with core Kubernetes yet.
Read the full story