Kubernetes security fundamentals: PKI

This post explains how Kubernetes uses PKI to secure TLS between system components, detailing the certificate inventory and separation of CAs (main, etcd, and front-proxy) and how kubelet client/server certificates are used. It calls out security risks such as the default unauthenticated API server-to-kubelet connection and self-signed kubelet server certs that enable sniffing/AITM, and it stresses protecting private keys (especially ca.key), understanding distribution nuances (e.g., RKE1 storing keys in a configmap), and the operational challenge that Kubernetes lacks CRL/OCSP, requiring CA rotation to revoke compromised client certificates—hence minimizing client certificate use.