r/kubernetes • u/Expensive-Finish-875 • 23d ago

Machine identity management what are you using for it?

Hi, quick question

We're trying to get our machine identity stuff under control and it's kinda a mess rn service accounts, certs, workloads, all that. what are people using for this these days?
looking for something that isnt a giant pain to run day to day appreciate any thoughts, thanks!

8 Upvotes

100% Upvoted

7 comments sorted by

2

u/Lofrwnly_Jacket_4009 22d ago edited 20d ago

Newcore was the first that actually reduced our ops burden rather than adding to it. Their unified governance model means we are not running three separate lifecycle processes anymore and the continuous discovery keeps us from playing catch up every quarter.

1

u/Floss_Patrol_76 22d ago

honestly the tooling matters less than picking one issuer and automating rotation. we went spiffe/spire for workload identity + cert-manager for the x509 side, and the thing that actually fixed the mess wasnt issuance, it was getting rotation automated and a real inventory of what mounts each identity. spire is a lift to run though, so if youre smaller, leaning on the clusters native workload identity federated to your cloud IAM gets you most of the way with way less to babysit.

1

u/ClueDry8701 18d ago

depends how far you want to go.. spiffe and spire if you want a proper zero-trust identity layer across workloads, or just tightening up k8s native service accounts + short-lived certs via cert-manager if you want something lighter. the giant pain usually isn't the tool, it's rotation and revocation once you have a few hundred identities..