Kubernetes v1.37 Pod Certificates: Why Bearer Tokens Were Never Enough

Service account JWTs have been Kubernetes’ workload identity primitive since 1.0. In v1.37, the project ships what replaces them for the most sensitive use cases — and the security argument is hard to dispute.

Kubernetes v1.37 Pod Certificates: Why Bearer Tokens Were Never Enough

Pod Certificates and Cluster Trust Bundles reached general availability in Kubernetes v1.37, marking the most significant shift in workload identity since the introduction of projected service account tokens in v1.21.

The problem being solved is structural. A service account JWT is a bearer token: whoever holds it can use it. Time-binding (expiry), object-binding (pod UID), and audience-binding all reduce the attack window — but none of them eliminate the fundamental exposure. If an attacker extracts the token from a running workload, a compromised node, or a misconfigured log pipeline, they can impersonate that workload’s identity until the token expires. For short-lived tokens that window may be minutes; for systems with clock skew or delayed revocation, it can be longer.

Pod Certificates solve this at the credential design level.

What Changes with Pod Certificates

A certificate is not a bearer token. The private key stays inside the workload — it is generated within the pod and never transmitted. What gets signed by the control plane CA is a certificate binding the pod’s identity to its public key. Any service that needs to verify the pod’s identity receives a proof-of-possession challenge: the workload must sign something with the private key that matches the certified public key. Possession of the certificate alone is not sufficient.

The practical mechanics in v1.37:

• Automatic issuance: The control plane issues certificates to pods before container startup. No sidecar, no init-container, no CSI driver required — the kubelet handles issuance directly.
• Filesystem delivery: Certificates are written to the container filesystem at a well-known path, making them accessible to any workload that can read a file.
• Automatic rotation: Certificates are kept current by the kubelet throughout the pod’s lifetime. Applications that reload TLS credentials on SIGHUP or use a file watcher get seamless rotation without restarts.
• Node restriction enforcement: The node restriction admission plugin ensures a kubelet can only request certificates for pods scheduled to that node. Lateral movement via a compromised node cannot obtain certificates for pods on other nodes.

The result is an X.509/TLS identity that fits naturally into any system that already understands mTLS — service meshes, external certificate authorities, HSM-backed trust hierarchies.

Cluster Trust Bundles: The Distribution Half

Certificates are only useful if the relying party trusts the CA that signed them. Cluster Trust Bundles are a new cluster-scoped resource that solves distribution.

A Cluster Trust Bundle packages one or more CA certificates and makes them available across the cluster via the Kubernetes API. Pods can mount a Trust Bundle the same way they mount a ConfigMap — the kubelet keeps the mounted content synchronized as the bundle is updated. This enables:

• Pod-to-pod mTLS: Workload A presents its Pod Certificate; Workload B verifies it against the Cluster Trust Bundle that contains the signing CA. No service mesh control plane required for basic mTLS.
• External service authentication: Services outside the cluster that accept X.509 client certificates can be configured to trust the cluster’s CA bundle. The pod authenticates by presenting its certificate.
• Zero-trust network models: Every connection can require mutual proof-of-possession, eliminating implicit trust from network adjacency.

What This Means for Platform Teams

The GA designation matters for platform engineering adoption. Alpha and beta features carry API stability caveats; GA means the API shape is stable and the feature is safe to build infrastructure on. Teams that have been waiting to standardize workload identity can now move.

The shift also surfaces a configuration decision: Pod Certificates and service account JWTs coexist in v1.37. Platform teams should evaluate which workloads benefit most from the upgrade — externally-facing services, secrets-adjacent workloads, and anything subject to compliance frameworks requiring mutual authentication are the obvious starting points.

For teams already using a service mesh for mTLS, Pod Certificates reduce the scope of what the mesh needs to manage for identity — the certificate lifecycle is handled by the control plane, not the mesh sidecar. That is a meaningful reduction in per-pod overhead at scale.

The Kubernetes v1.37 deprecations preview covered other changes in this release. Pod Certificates is the feature most likely to change how platform teams architect workload identity going forward.

Content created with AI assistance and reviewed for accuracy.