Managing Kubernetes Webhooks with SPIRE
summary
SPIRE automates webhook certificate lifecycle: it pushes the SPIRE root CA into webhook configs via the k8s-bundle-notifier plugin, creates the required SVID entry (DNS name service.namespace.svc) and runs a watcher that writes tls.crt and tls.key to disk for webhook servers. Requires SPIRE >= 1.2.2. Also adds the same rotation for APIService CA bundles (supports APIService ca bundle). Implemented in production with nginx service mesh and replaces the need for cert-manager; basic rotation works, large-scale limits not yet tested.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:38Webhook refresher
- 4:17Sample configuration
- 6:20Solution: Use SPIRE
- 7:10Keep the caBundle fresh
- 9:24Create the entry
- 10:41Save cert/key to disk
- 16:15NGINX Service Mesh
related talks
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
16mUsing a CRD to better integrate SPIRE and Kubernetes
37mSPIFFE Deep Dive
29mBeyond Proof of Concept: Keys to a Successful SPIRE Rollout in Production
38mImproving Secure Pod-to-Pod Communication Within Kubernetes Using...
37mZero Trust Workload Identity in Kubernetes
34mSPIRE: Intro & Deep Dive Into Windows Support