pod-cert-signer — a signer for pod certificates, the CA key stays in KMS.

Why a signer of my own

Kubernetes 1.37 made pod certificates stable but ships no signer. Support in cert-manager has been open since January (cert-manager#8378). I needed certificates for the CrowdSec agents in my cluster, which talk to the central LAPI from other namespaces, and no further shared CA in the cluster. How the migration went, obstacles included, is in the field note.

The signer is kept small because it is the most privileged component. It talks to the Kubernetes API in a few hundred lines on the standard library instead of client-go. It uses the AWS SDK for credentials and KMS only: authentication is not something to write yourself. The tests run against a fake API server that speaks the watch protocol and enforces the API's time rules. A mutation run removes ten rules one at a time, and every mutant has to turn the suite red.

How a pod gets its certificate

The signer creates its CA certificate once itself, with the key in KMS. It carries critical name constraints: only .svc, .svc.cluster.local and its own trust domain.

KMS_KEY_ID=alias/pod-cert-signer pod-cert-signer init \
  -cn "Example workload CA" -trust-domain example.com > ca.crt

A pod requests its certificate with a volume:

volumes:
  - name: tls
    projected:
      sources:
        - podCertificate:
            signerName: example.com/workload
            keyType: ECDSAP256
            keyPath: tls.key
            certificateChainPath: tls.crt
        - clusterTrustBundle:
            signerName: example.com/workload
            labelSelector: {}
            path: ca.crt

The pod does not start until the certificate is issued. Who gets what is a JSON policy, mounted from a ConfigMap:

{"namespace": "team-a", "serviceAccount": "api", "usage": "server",
 "dnsNames": ["api.team-a.svc", "api.team-a.svc.cluster.local"]}

Anything not granted is denied, with one of four reasons: NoGrant, UnsupportedKeyType, DNSNameNotGranted, InvalidStubPKCS10Request. Because of the name constraints, even a bypassed policy check cannot issue a certificate for a public name.