Platform EngineeringTrusted CA Injection in Enterprise Kubernetes
Custom CAs are everywhere in enterprise Kubernetes — TLS inspection proxies, internal PKI, self-signed services. Containers don't trust them out of the box. Here is why every common workaround breaks at scale, what runtime-level injection via containerd NRI actually does in production, and the concrete code paths and failure modes we hit getting cainjekt operational across our managed fleet.
- Why every enterprise platform with custom CAs has this exact problem
- How four common workarounds (image baking, volume mounts, init containers, mutating webhooks) break at scale, with concrete failure modes
- How containerd NRI enables transparent runtime-level injection
Open source under github.com/natrontech/cainjekt
