PodCertificateRequests is a new API (introduced in Kubernetes v1.34 as alpha) that enables the provisioning of certificates to workloads running as Pods within a cluster. Here’s a controller to simplify leveraging this new feature.

Pod-certificate-signer is a controller that creates PodCertificateRequest for your Pods with a custom x509 signer. This tool:
- signs TLS/mTLS certificates for Pods (or denies issuing them based on the relevant configuration);
- allows you to use Pod annotations for certificate configurations;
- validates requests by checking whether the CA-provided or mounted files exist and ensuring that the CA is valid;
- logs all decisions and errors.

Language: Go | License: Apache 2.0 | 1 ⭐️

▶️ GitHub repo

#tools #security