Identity with certificates in Kubernetes
summary
Explains how Kubernetes authenticates components by signing CSRs using a cluster CA, demonstrates generating keys and CSRs with cfssl (also mentions OpenSSL), turning a CSR into a Kubernetes object via certificate.k8s.io/v1, approving with kubectl certificate approve, signing with a local CA, uploading the signed cert, and verifying the CSR moves from pending to approved and issued. Shows base64-encoded CSR flow, default 1-year cert lifetime, bootstrap/rotation mechanics and kubeadm versus manual API-based signing.
AI-written summary · about
chapters (15)
- 0:00Introduction to talk
- 0:28What are certificates and PKI
- 2:35Why certificates in Kubernetes
- 3:16Cluster Certificate Authority
- 4:19Generating certificates with OpenSSL
- 5:46Certificate generation APIs
- 7:35Hands-on demo setup
- 7:55Generating first CSR
- 10:02Sending CSR to Kubernetes API
- 11:33Approving the CSR
- 13:06Creating Certificate Authority
- 14:10Issuing signed certificate
- 15:16Uploading signed certificate
- 17:50Certificate bootstrap and rotation
- 20:00Q&A session
related talks
19mSecurity with Certificates in Kubernetes
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
15mCertificates in Kubernetes
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
19mIdentity, Istio, And You
29mEverything Wrong with K8s Authentication and How We Worked Around It
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
15mSecuring your app's communications with Kubernetes, Azure Key Vault, and TLS certificates