Sig Auth Deep Dive
summary
Pod Security Admission graduates to stable in 1.25 and replaces most PSP use cases; certificate signing now honors requested durations down to 10 minutes. KMS V2 hits Alpha in 1.25 with a reference implementation (target beta 1.27), defaulting to GCM encryption, adding a key‑hierarchy cache that cuts thousands of remote KMS calls to roughly one per API server, a status API, per‑operation UID, and a protobuf on‑disk format. CRD encryption and hot‑reload arrive in 1.26, and legacy auto‑generated service‑account tokens stop in 1.24 with a 1.26 migration alpha.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:55Pod Security
- 3:43Encryption at Rest Improvements - v1 & v2
- 11:04KMS v2 - Encrypt Request
- 15:13Client Exec Proxy
- 16:26Cluster Trust Bundles
- 17:58Legacy Service Account Tokens
- 20:51Structured OIDC config
- 23:03Structured authorization config
- 24:37Cross SIGs Work
related talks
36mSIG Auth Deep Dive
01h 32mSIG Auth Update and Deep Dive
35mPSP is Dead, Long Live PodSecurity
25mSecuring Meta's Production PKI Credentials
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
54mEnabling Message Level Protection at Uber
22mgRPC and Post-Quantum Cryptography
46mAchieving Quantum Readiness: A Comprehensive Approach