Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles Are Now GA

Service Account JWTs have been Kubernetes’ primary workload identity mechanism for years, and they have a fundamental flaw that cryptography cannot paper over: they are bearer tokens. Whoever holds the token can use it. Kubernetes v1.37 adds the GA graduation of a different model — one where possession of the credential is not the same as the right to use it.

What Happened

Kubernetes v1.37 (Garhwal) graduates two complementary features to general availability: Pod Certificates and Cluster Trust Bundles.

Pod Certificates give workloads X.509 certificates for TLS and mutual TLS (mTLS) authentication, managed automatically by the Kubelet in the same way service account tokens are managed today. The private key stays inside the workload; what gets transmitted to peers is a signed certificate describing the workload’s identity.

Cluster Trust Bundles distribute Certificate Authority (CA) certificates across the cluster, giving workloads a mechanism to verify the certificates their peers present. Together, the two features form a complete in-cluster PKI that requires no external certificate management tooling to operate.

The Kubernetes blog post on v1.37 provides full implementation detail, including integration guidance for workloads transitioning from service account JWTs.

Why It Matters

The bearer token problem is structural. A service account JWT is a credential that proves identity by its existence — present the token, get access. If the token is intercepted, forwarded to a malicious peer, or logged somewhere it shouldn’t be, the attacker can impersonate the original workload for the duration of the token’s validity. The only defenses are tight rotation windows and access control on where tokens can go.

Proof-of-possession credentials change the model. With X.509 certificates and asymmetric cryptography, the workload never transmits the private key. Cryptographic signatures prove that the workload possesses the key without revealing it. A peer receiving an impersonated credential has no matching private key, so the authentication handshake fails.

This is the standard TLS trust model the rest of the internet runs on. Kubernetes has had per-node certificates since early versions, but production workload identity at the pod level has historically required external solutions — service meshes, cert-manager deployments, or Vault integrations. Pod Certificates move that capability into the control plane.

What This Means for Builders

GA status means stable API — the feature is safe to build production systems against without worrying about breaking changes in subsequent releases. Node restriction enforcement follows the same Kubernetes least-privilege principles platform engineers already rely on. Certificates are automatically rotated by the control plane, matching the low-operational-overhead model of service account JWTs.

Practical migration paths exist alongside rather than instead of existing JWT-based authentication. The Kubernetes project designed Pod Certificates to coexist with service account tokens, which means platform teams can adopt mTLS incrementally rather than requiring a cluster-wide migration event.

For HashiCorp Vault users specifically, this change is worth evaluating against existing PKI workflows — Pod Certificates represent a native Kubernetes alternative for workloads that use Vault primarily for certificate issuance within the cluster.

Source: Kubernetes Blog

Content created with AI assistance and reviewed for accuracy.