Lightning Talk: Your Wish Is Our Command: Declarative Certificate Management in a...
summary
A declarative custom resource, MeshRootCertificate (MRC), centralizes certificate configuration and lets the mesh perform provider migrations and root rotations automatically. The MRC exposes a active/passive/inactive roles field that controls which CA signs new leaf certs and which CAs live in validation contexts, enabling staggered swaps via kubectl apply while the controller updates Envoy sidecars without downtime. Current providers include cert-manager, HashiCorp Vault, stressor. A validating webhook enforces the safe role transition pattern.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:49Terminology
- 1:21Certificates in a Mesh
- 1:48Managing Mesh Certificates
- 2:28Simplifying Management
- 3:15Custom Resource Definition
related talks
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
30mCert-Manager Beyond Ingress – Exploring the Variety of Use Cases
15mCertificates in Kubernetes
36mYou Like It Or Not; You Need It! - PKI And Certificate Management
26mcert-manager - Past, Present and Future
13mBOSH & SSL Certificates - Rotating Certificates Smoothly
31mPractical TLS Advice for Large Infrastructure
36mCertifik8s: All You Need to Know About Certificates in Kubernetes