Kubernetes v1.37: Mastering Pod Certificates and Cluster Trust Bundles

Kubernetes v1.37 brings a game-changing feature: Pod Certificates and Cluster Trust Bundles. This built-in identity technology addresses the need for secure communication between workloads by integrating X.509 certificate issuance directly into the core of Kubernetes. It simplifies the management of TLS and mTLS, allowing your applications to authenticate securely without the overhead of external tools.

The mechanism behind this feature involves several key components. Your application requests certificates in its pod specification and reads the keys, certificates, and trust bundles from the container filesystem. Kubelet plays a crucial role by issuing PodCertificateRequest objects and managing ClusterTrustBundle objects on behalf of your workloads. The signer controller responds to these requests, deciding whether to issue the certificate and writing it to the container filesystem. Notably, Kubelet also updates these files periodically as the contents of the selected ClusterTrustBundles change, ensuring your applications always have the latest trust information.

In production, you must be aware of a few important details. Automatic rotation of certificates is built in, but your applications need to handle this correctly. Certificates issued by signers in core Kubernetes have a maximum lifetime of 24 hours, while other signers can go up to 91 days. To leverage these features, you'll need to install a third-party signer into your cluster, which adds an extra step in your deployment process. Understanding these nuances will help you implement this technology effectively and securely.