Building Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager
The original post from the OTUS blog describes a practical approach to replacing insecure TLS configurations in a Kubernetes cluster. The environment uses Talos as the operating system, Cilium for networking, and Linstor for storage. While pods can already communicate and persist data, most internal traffic still relies on self-signed certificates that no party trusts by default.
The solution centers on three core components. First, cert-manager provisions an internal CA using a bootstrap self-signed issuer to create the CA certificate itself. A subsequent ClusterIssuer named internal-ca then signs workload certificates, storing them in Secrets with automatic renewal. Second, trust-manager extracts only the public portion of the CA and distributes it cluster-wide as ConfigMaps via a Bundle resource, enabling workloads to verify certificates without receiving private keys.
For external exposure, a separate ACME issuer connected to Let's Encrypt automates certificate issuance. When Gateway API is present, cert-manager temporarily creates an HTTPRoute for HTTP-01 challenges and cleans it up afterward. The article also addresses the kubelet serving certificate, which defaults to a self-signed value that the API server often skips verifying.
Enabling serverTLSBootstrap in Talos allows the kubelet to request a properly signed certificate via the Kubernetes CSR API. The kubelet-serving-cert-approver controller then inspects each request against the corresponding Node object, approving only those whose SANs match the node's name and addresses. This replaces the common --kubelet-insecure-tls behavior.
The post emphasizes that these insecure patterns can persist undetected because Kubernetes provides no explicit warnings. API server logs and kubectl commands continue to function while half the control-plane traffic bypasses certificate validation. Implementing the described issuers, trust distribution, and CSR approver creates a consistent trust model that works across any Kubernetes distribution, with only one Talos-specific line required for kubelet certificate rotation.
Related articles
AS2 in .NET Without Separate Java Gateway: Native EDI Exchange Directly in Application Routes
redb.Route.AS2 introduces native AS2 protocol support for .NET applications, eliminating the need for separate commercial gateways or Java-based servers like OpenAS2. The library integrates AS2 handling as a standard step in Apache Camel-style routes, allowing signed and encrypted S/MIME exchanges with partners such as Walmart directly within a single .NET process. It supports both synchronous and asynchronous MDN receipts for non-repudiation, using MimeKit and Bouncy Castle for cryptography. Developers can configure partners via As2ConnectionFactory objects that define certificates, AS2 identifiers, algorithms, and MDN modes. The solution handles X12 and EDIFACT documents with compression, signing, and encryption while exposing metadata like MIC values and signature validation results to the routing pipeline. This approach consolidates deployment, observability, and processing compared to external gateways or JVM processes.
Browser Policy Manager 0.9.5 Release Candidate Adds Comprehensive Multi-Language Documentation Portal
Browser Policy Manager (BPM) is approaching its 1.0.0 release as an open-source tool designed for preparing, validating, and exporting Firefox Enterprise policy profiles. The 0.9.5 update introduces four current Firefox schema channels including Release 153, ESR 153.0, ESR 140.13, and ESR 115.38, along with migration assistance from older ESR versions. A full documentation portal built in DITA now ships with the product, covering user guides, Firefox policy references, CIS benchmark mappings, and administrator instructions across six languages. The portal integrates directly with the BPM interface through manifests and UI target maps, providing contextual help without server dependencies. Local search uses static indexes with deterministic ranking, while future RAG capabilities are planned with strict source verification and no model training on documentation. The project emphasizes reproducible builds, locale completeness checks, and clear separation between automated mappings and manual compliance validation.
Same-Origin Policy and CORS: How Browsers Enforce Web Security Boundaries
The article explains the core browser security mechanism known as Same-Origin Policy that prevents scripts from one website from reading data belonging to another. It details how origin is defined strictly by protocol, domain, and port, and why this matters for everyday web interactions such as banking sessions. The text clarifies that the policy blocks reading of cross-origin responses while still allowing loading of images, scripts, and iframes. CORS is presented as the controlled relaxation of this rule, where the target server explicitly grants permission via response headers. The piece emphasizes that CORS does not protect servers from direct requests made outside browsers and that authentication remains the true defense for APIs. Multiple practical examples illustrate the difference between displaying foreign content and programmatically reading its data.
Security Vision 5 Strengthens Connectors, Analytics and Data Handling Features
Security Vision has released an update to its SV5 platform focused on improved integrations, deeper analytics and more flexible configuration management. The release introduces namespace configuration for the WMI connector to execute WQL queries at specified addresses, along with event compression during transmission in connector configurations. An updated librdkafka library now enables the Kafka connector to support SASL/SCRAM authentication for Kafka versions 4.0.0 and higher. Data transformation capabilities have been expanded to allow conversion of numbers between binary, octal and hexadecimal numeral systems, while the Formula transformation adds abs() and sqrt() functions. Linear and bar charts receive new scaling settings, and report generation through the portal has been moved to asynchronous mode to prevent interface freezing during long exports. Additional changes affect object cards, type and directory editors, module settings, graph icon management with mapping conditions converted to filters, and a dedicated section for correlation rules with a general view and editor. The audit log now records grouping changes separately for system and user directories, and the platform blocks execution of disabled connectors through workflows.