Topic

Mutual TLS authentication

Authenticating both ends of a network connection with X.509 certificates, so a client proves its identity with a key pair instead of a shared password.

Current clusters

product1 publisher

A CNCF walkthrough runs OpenBao on a three-instance Postgres cluster with certificate-only logins

The Linux Foundation's fork of Vault can keep its encrypted key-value store inside a CloudNativePG cluster where pg_hba forces both database roles to present a TLS client certificate. The published recipe runs on a six-node Kind playground.

Publishers:cncf.io

Reality

Evidence60
Adoption: Insufficient
Hype gap+15
Incentives70
Confidence55