Kubernetes 1.37 Pod Certificates and SPIFFE: Similar ideas, different layers
Kubernetes 1.37 introduced two features that immediately caught my attention: Pod Certificates and ClusterTrustBundles. ( https://kubernetes.io/blog/2026/08/28/kubernetes-v1-37-pod-certificates-and-cluster-trust-bundles/ )
If you are familiar with SPIFFE and SPIRE, some of this will sound surprisingly familiar. Short-lived certificates for workloads, automatic certificate rotation, istribution of trusted CA certificates…
First thing that came to my mind was whether Kubernetes is starting to build its own version of SPIFFE. There is definitely overlap, but the two systems are solving different layers of the workload identity problem.