Improving Secure Pod-to-Pod Communication Within Kubernetes Using Trust Bundles
Explore a 38-minute conference talk on enhancing secure pod-to-pod communication in Kubernetes using trust bundles. Delve into new features being added to Kubernetes that allow for specifying roots of trust for cluster applications. Learn about the implementation of "trust bundles" or trust anchor sets, and discover updates to previous work on creating convenient mechanisms for providing certificates to every pod. Examine how these certificates can be accessed and utilized for mutual authentication. Gain insights into leveraging the cert-manager project, SPIFFE project, and KEP-3257 for trust anchor sets to automate TLS certificate creation for pods and establish mTLS patterns. Compare and contrast this approach with current methods of cluster communication security, such as service meshes, and explore areas for further refinement in this evolving Kubernetes ecosystem.