Kubernetes Pod Certificates vs SPIFFE/SPIRE vs cert-manager: Choosing Workload mTLS in 2026
Pod certificates went stable in Kubernetes v1.37. How built-in pod certs compare with SPIFFE/SPIRE and cert-manager on trust, rotation and cost.
SPIFFE & SPIRE: Workload Identity Architecture for Zero Trust (2026)
SPIFFE and SPIRE workload identity explained: SPIFFE IDs, X.509 and JWT SVIDs, node and workload attestation, trust domains and mTLS - the reference architecture for zero-trust service identity in 2026.
Zero Trust Network Architecture Implementation Guide: From NIST 800-207 to Production
Practical zero trust architecture — policy decision point, policy enforcement point, mTLS, SDP, identity-aware proxies, and migration from perimeter-based networks.