Kubernetes v1.37 Introduces Pod Certificates and Cluster Trust Bundles for Identity

New Identity Mechanism in Kubernetes v1.37

Kubernetes v1.37 introduces Pod Certificates and Cluster Trust Bundles as a new built-in production identity technology, now generally available. This feature integrates X.509 certificate issuance for TLS and mTLS directly into the Kubernetes core, providing a more secure method for workloads to authenticate to other systems.

Addressing Service Account JWT Limitations

Previously, service account JSON Web Tokens (JWTs) were the primary identity mechanism. While JWTs offer benefits like automatic management by Kubelet, least-privilege issuance, and federation capabilities for cloud authentication, they are bearer tokens. This means possession of a JWT grants full identity assertion, posing a security risk if tokens are compromised.

Proof-of-Possession Credentials

The new Pod Certificates system aims to solve the bearer token problem by implementing proof-of-possession credentials. Unlike bearer tokens, this method does not require sending the entire credential to a peer. Instead, it sends only a proof of possession, enhancing security by preventing unauthorized use even if the proof is intercepted. These schemes are typically built on asymmetric cryptography.

Impact on Workload Security

This update significantly improves the security posture for Kubernetes workloads by providing a more robust identity system. By moving away from easily compromised bearer tokens to proof-of-possession credentials, Kubernetes clusters can achieve stronger authentication and reduce the risk of identity theft within and across services.