Kubernetes 1.37 Pod Certificates and Cluster Trust Bundles GA: Workload Identity Guide
Pod Certificates and ClusterTrustBundles reach GA in Kubernetes 1.37. How pod X.509 identity works vs SPIFFE and cert-manager, with migration steps.
Kubernetes Pod Certificates vs SPIFFE/SPIRE vs cert-manager: Choosing Workload mTLS in 2026
Pod certificates went stable in Kubernetes v1.37. How built-in pod certs compare with SPIFFE/SPIRE and cert-manager on trust, rotation and cost.
SPIFFE & SPIRE: Workload Identity Architecture for Zero Trust (2026)
SPIFFE and SPIRE workload identity explained: SPIFFE IDs, X.509 and JWT SVIDs, node and workload attestation, trust domains and mTLS - the reference architecture for zero-trust service identity in 2026.