Building Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager
The original post from the OTUS blog describes a practical approach to replacing insecure TLS configurations in a Kubernetes cluster. The environment uses Talos as the operating system, Cilium for networking, and Linstor for storage. While pods can already communicate and persist data, most internal traffic still relies on self-signed certificates that no party trusts by default.
The solution centers on three core components. First, cert-manager provisions an internal CA using a bootstrap self-signed issuer to create the CA certificate itself. A subsequent ClusterIssuer named internal-ca then signs workload certificates, storing them in Secrets with automatic renewal. Second, trust-manager extracts only the public portion of the CA and distributes it cluster-wide as ConfigMaps via a Bundle resource, enabling workloads to verify certificates without receiving private keys.
For external exposure, a separate ACME issuer connected to Let's Encrypt automates certificate issuance. When Gateway API is present, cert-manager temporarily creates an HTTPRoute for HTTP-01 challenges and cleans it up afterward. The article also addresses the kubelet serving certificate, which defaults to a self-signed value that the API server often skips verifying.
Enabling serverTLSBootstrap in Talos allows the kubelet to request a properly signed certificate via the Kubernetes CSR API. The kubelet-serving-cert-approver controller then inspects each request against the corresponding Node object, approving only those whose SANs match the node's name and addresses. This replaces the common --kubelet-insecure-tls behavior.
The post emphasizes that these insecure patterns can persist undetected because Kubernetes provides no explicit warnings. API server logs and kubectl commands continue to function while half the control-plane traffic bypasses certificate validation. Implementing the described issuers, trust distribution, and CSR approver creates a consistent trust model that works across any Kubernetes distribution, with only one Talos-specific line required for kubelet certificate rotation.
Related articles
RANEPA Opens Specialized IT Laboratory for Training Specialists in Russian Software
The Presidential Academy of National Economy and Public Administration (RANEPA) has launched a dedicated IT laboratory focused on Russian software and infrastructure management. The facility was established with support from RED SOFT, R7, and ICL Techno, equipping 15 OSiO mini-PCs and monitors with RED OS and R7 Office. Students will gain hands-on experience from operating system installation through virtualization, database administration, and office productivity tasks. The project includes four specialized courses on RED OS, permanent software licenses with updates and support, and opportunities for developer certificates and internships. The laboratory will primarily serve students from the Institute of Public Service and Management and the Institute of Economics, Mathematics and Information Technologies, covering topics such as digital literacy, data management, artificial intelligence, and municipal analytics. RANEPA aims to maintain at least 90 percent utilization of the specialized classroom.
Russia Expands Mobile Number Portability to Allow Inter-Regional Transfers Starting September 1
From September 1, Russian subscribers can retain their mobile number when moving to another region and either switch to a new operator or stay with the existing one if coverage is available. Previously, the Mobile Number Portability service was restricted to transfers within a single federal subject, forcing users who relocated from cities such as Kazan to Moscow to obtain a new number or accept outdated regional tariffs. The updated rules remove this geographic limitation, reducing the administrative burden of updating contacts, banking applications, and online accounts linked to the phone number. Operators will now face greater competition because regional restrictions can no longer be used as a retention tool. Usage of the service has already grown sharply, with more than 4.3 million numbers ported in the first half of 2026, double the 2.1 million recorded in the same period of 2025. Since the launch of MNP in 2013, over 41 million numbers have changed operators, and the new inter-regional capability is expected to accelerate that trend further.
UserGate Launches Rugged Industrial NGFW uNGFW on X10 Platform Rated for -40 to +60 °C
UserGate has introduced the uNGFW next-generation firewall running on the new X10 hardware platform designed specifically for protecting industrial control systems and OT environments. The appliance replaces the discontinued X1 model and is engineered to operate reliably in harsh conditions ranging from −40 to +60 °C with up to 80 % humidity, allowing direct DIN-rail installation inside automation cabinets at substations, extraction sites, and fuel stations. It provides deep inspection for 35 industrial protocols including Modbus, OPC UA, Profinet IO and S7Comm, with intrusion-prevention rules capable of validating individual commands on six critical protocols to block unauthorized actions without requiring equipment shutdowns. Hardware redundancy features two independent power inputs and a bypass function that maintains network connectivity during device failure, while maximum power draw remains at 24 W. Throughput reaches 1780 Mbit/s with support for up to 500 000 concurrent connections, and centralized management via UserGate’s existing console enables unified policies across distributed sites. The platform was developed by UserGate’s own design bureau and is manufactured in Saint Petersburg; it is already available for ordering and testing through company partners.
Aiker World AI Co-Creation Base Officially Lands in Hainan Oriental to Build Long-Term AI Talent and Industry Ecosystem
On August 28, the finals of the Oriental Chuxin FC-OPC Next iCreate AI Native Content Creation Competition were held in Hainan Oriental. Aiker World community, in partnership with Oriental Chuxin, advanced their collaboration by establishing an offline AI co-creation base and connecting online talent with real industrial scenarios. Thirty youth teams presented AI projects focused on Chinese cultural dissemination, Hainan tourism and intangible heritage export, free trade port digital economy, and AI content compliance. The event was attended by senior local officials including Oriental Municipal Party Secretary Li Aihua and Hainan Provincial Tourism and Culture Department Deputy Director Wang Zhongyun. 360 Group representative and Aiker World initiator Hu Xiaona highlighted the shift from AI model development to practical enterprise deployment using tools like Nami Work. The new base aims to link talent, experts, and companies for sustained project delivery beyond single events.