KubeCon + CloudNativeCon Europe 2025

Service account signing keys are critical for JWT signing and authentication in Kubernetes, yet the current model - loading keys from disk during kube-apiserver startup - introduces challenges in key rotation and security. Restarting kube-apiserver for key rotation disrupts operations, while storing signing keys on disk exposes sensitive materials to potential exfiltration. This talk explores KEP 740 which is an enhancement to Kubernetes’ service account key management, enabling seamless integration with HSMs and cloud KMSes. By offloading signing to external systems, we eliminate the need for restarts during key rotations and significantly enhance security by removing signing materials from the filesystem. Join us to learn how these updates can strengthen security and auditability, and provide Kubernetes distributions with the flexibility to choose key management solutions that meet their needs.