Certifik8s: All You Need to Know About Certificates in Kubernetes
summary
Explains how a single cluster CA signs all component certs, with the controller-manager holding the CA key and two controllers that auto-approve kubelet CSRs and sign them so nodes boot via kubelet TLS bootstrapping. Demonstrates the CSR API flow, notes kubelets auto-rotate client certs in Kubernetes 1.8 while serving-cert rotation is still alpha, and shows ingress TLS via secrets or automated certs with kube-lego/Let’s Encrypt. Mentions cosMatic/KubeADM tooling and CA/cert lifetimes (CA ~2–3 years, issued certs ~1 year).
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:31Certificate Refresher
- 4:05Why Certificate in Kubernetes
- 5:13Certificate Authority
- 5:53API Server
- 8:59Client Cert Authentication
- 10:06Cubed Cert
- 12:12Kubernetes Certificate API
- 13:38Demo
- 19:58Summary
- 21:24Missing Feature
- 23:28Container Identity Working Group
- 24:34Recap
- 26:17Questions
- 26:40Controller Manager
- 29:06Single CA
- 30:09Private Keys
- 30:46External Key Management
- 31:39Master Certificates
related talks
15mCertificates in Kubernetes
22mIdentity with certificates in Kubernetes
19mSecurity with Certificates in Kubernetes
38mImplementing Cert-manager in K8s
31mHow Kubernetes Components Communicate Securely in Your Cluster
29mEverything Wrong with K8s Authentication and How We Worked Around It
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions