Strengthening Auth in Kubernetes: Image Pulling, DRA Admin Access & Pod Certificates
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 11:45· Level 3 | ICC Capital Suite 10-12·
summary
Kubernetes Auth SIG lands concrete features: v1.33 GA adds bound ServiceAccount tokens with node and jti claims for replay protection; cluster trust bundles let nodes project signer CAs into pods and demos show the projection working; image-pull enforcement records per-pull credentials and forces re-auth when a different pod tries to use an on-node image; service account image pull credentials request short-lived tokens for kubelet providers; DRA admin access gates privileged ResourceClaimTemplates to labeled admin namespaces; external gRPC signing and pod client cert minting are in flight.
AI-written summary · about
chapters (16)
- 0:00Kubernetes auth updates
- 1:02Graduated features v1.33
- 3:54Kubelet API authorization
- 4:37UIDs in authenticators
- 6:25Upcoming security features
- 7:08Unauthorized image pulls
- 9:37Service account image pulls
- 10:59DRA admin access
- 12:04Service account token signing
- 13:13Projected certs for accounts
- 14:15Future Kubernetes hardening
- 15:19PSA restrictions
- 16:02Demo: DRA admin access
- 21:16Demo: Secure image pulling
- 25:39Demo: Cluster trust bundles
- 29:13Closing & Q&A
related talks
36mSIG Auth Deep Dive
41mKubernetes Auth and Access Control
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
38mBuilding for Trust: How to Secure Your Kubernetes Cluster
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
35mRBAC to the Future: Untangling Authorization in Kubernetes
39mDeep Dive: Auth SIG
37mCaller ID in Kubernetes