As Kubernetes deployments expand into highly regulated industries and critical infrastructure, the gap between built-in certificate management and enterprise-grade trust requirements is becoming impossible to ignore. While Kubernetes handles simple certificate automation, organizations operating in air-gapped environments, sovereign zones, or under strict compliance mandates like NIS2, DORA, and the Cyber Resilience Act need something more: full lifecycle control over their PKI, crypto agility for post-quantum transitions, and the ability to integrate with existing trust frameworks. At KubeCon + CloudNativeCon North America 2025 in Atlanta, Keyfactor is making the case that digital trust shouldn’t be outsourced—and that developers and platform teams can take it back under their control.
In this pre-show VMblog Q&A, Malin Ridelius, Head of Community and Developer Relations at Keyfactor, reveals how the company’s open-source technologies—EJBCA for PKI and SignServer for signing operations—are addressing the security challenges of modern cloud-native infrastructure, from securing containerized AI agents with mutual TLS to preparing enterprises for quantum computing threats. With a live demo featuring Claude Code autonomous containers deployed into an Istio service mesh protected by EJBCA-issued workload identity certificates, Keyfactor’s Booth 642 will showcase what zero-trust, identity-first architecture looks like in practice. As TLS certificate lifespans shrink to 47 days by 2029 and AI agents reshape the security landscape, Ridelius discusses why establishing cryptographic control and compliance at scale has never been more critical—and how organizations can build resilient, future-proof trust infrastructures that keep pace with the speed of cloud-native innovation.
VMblog: Can you give us your elevator pitch? What key message will attendees hear from you at KubeCon NA 2025, and what actionable insights will they take back to influence their management teams?
Malin Ridelius: At Keyfactor, we enable developers and platform teams to take digital trust back under their control. Our open-source technologies, which include EJBCA for public key infrastructure (PKI) and SignServer for signing, extend beyond the basic certificate automation built into Kubernetes. While Kubernetes handles simple certificate management, highly regulated industries and critical infrastructure demand sovereign, compliant PKI that integrates with existing trust frameworks, supports crypto agility, and operates securely even in disconnected or isolated environments.
At KubeCon + CloudNativeCon NA 2025, we’ll show how to bring your own PKI (BYO PKI) into Kubernetes, including how to manage certificate lifecycles, sign containers, and prepare for post-quantum cryptography (PQC), all while aligning with compliance mandates such as NIS2, DORA, and the Cyber Resilience Act.
Attendees will walk away with actionable architectures and best practices for building resilient, compliant, and self-sovereign trust infrastructures – insights they can immediately use to strengthen their organization’s digital trust strategy.
VMblog: As a sponsor of KubeCon + CloudNativeCon North America 2025, what sponsorship level have you chosen, and what strategic objectives drove this investment?
Ridelius: We’re proud to be a Silver Sponsor at KubeCon + CloudNativeCon NA 2025. Our investment is driven by a belief that trust should not be outsourced. Many Kubernetes-native solutions handle internal communication just fine. But when infrastructure spans clouds or sovereign zones, organizations need full lifecycle control over their certificates and signing operations.
Our focus is on empowering developers and platform teams in regulated and high-assurance environments. By sponsoring KubeCon, we are connecting with the engineers designing that future and showing them how to build secure, compliant systems with the same automation and velocity they expect from Kubernetes.
VMblog: Where can attendees find you at the event? What hands-on demos, interactive experiences, or booth activities have you designed to showcase your technology?
Ridelius: Attendees can find us at Booth 642. We’ll be hosting live demos at the booth, including a showcase of an AI agent running in a container environment, powered by Claude code integrated with Keyfactor’s PKI solutions. Agentic AI brings great benefits to organizations when it comes to operational efficiency through automation – but security must not be forgotten. Modern agents are best suited to shorter tasks that are often amenable to containerized workloads for stability and consistency. Visit the Keyfactor booth to see our demo where we deploy one of these autonomous Claude Code containers into an Istio service mesh that’s been configured to both provision and enforce mutual TLS mesh-wide using workload identity certificates from EJBCA, your trusted enterprise PKI. The demo illustrates how developers can securely provision, authenticate, and manage agentic workloads using trusted digital identities from EJBCA and SignServer.
Attendees can stop by the booth to see the demo in action, meet our technical experts, and discuss PKI, container signing, digital trust, and strategies for implementing zero-trust, identity-first architectures in their own Kubernetes environments. We’d love to connect and share insights on taking trust back under your control.
VMblog: How has your company’s KubeCon presence evolved since your first participation? What value keeps driving your continued investment in this community?
Ridelius: Our presence at KubeCon has evolved alongside the Kubernetes ecosystem itself. From the start, our goal has been to position our open-source PKI and signing solutions as foundational building blocks for organizations that prioritize compliance, auditability, and trustworthy security foundations. While Kubernetes’ native certificate authority (CA) and SPIRE capabilities handle ephemeral workloads and in-cluster identity, they don’t address environments requiring trust sovereignty (in which you own and control your root and intermediate CAs), air-gapped operations, cross-cluster or hybrid trust domains, and regulatory compliance under frameworks like NIS2, DORA, CRA, and FIPS.
EJBCA provides enterprise-grade PKI lifecycle management with complex hierarchies, auditability, and crypto agility, while SignServer delivers flexible signing orchestration for code, containers, SBOMs, and firmware, all within the environments developers already use. Together, they enable organizations to build resilient, compliant, and future-proof trust infrastructures in Kubernetes and beyond.
We continue to invest in KubeCon because the CNCF community’s momentum around workload identity, supply chain signing, and post-quantum readiness aligns perfectly with our mission to provide cryptographic control and compliance at scale. As Agentic AI and autonomous workloads become part of modern cloud infrastructure, ensuring authenticity, integrity, and verifiable identity across these systems is more critical than ever. This community pushes boundaries faster than any other, and we’re here to ensure digital trust keeps pace, from traditional workloads to the emerging world of AI-driven automation.
VMblog: With GenAI workloads and LLM deployments reshaping cloud-native architectures, how does your solution address these AI infrastructure demands?
Ridelius: While our primary focus is on agentic workloads, our approach applies to any cloud-native workload, including generative AI or LLM deployments. Using EJBCA or our broader PKI management ecosystem, organizations can seamlessly provision identity certificates for each workload, ensuring that every system, whether traditional, GenAI, or agentic, leverages the same trusted enterprise PKI. This means developers and platform teams can maintain consistent, auditable, and compliant cryptographic controls across all workloads, enabling secure operations and governance as AI becomes a core part of cloud infrastructure.
VMblog: What’s your executive pitch for CTOs and CIOs? How do you demonstrate measurable business impact and ROI?
Ridelius: In today’s hybrid and zero-trust environments, every identity-human and machine-must be authenticated, authorized, and continuously validated. Zero trust can’t be retrofitted, and agents can’t be fully audited without it; you need zero trust in place before deploying agents to your workforce. These principles are embedded into everything we do, which allows Keyfactor to empower CTOs and CIOs to take control of machine identities across the enterprise, reducing risk, ensuring compliance, and enabling secure digital transformation. By establishing this foundation, organizations achieve measurable ROI through fewer security and outage incidents, simplified compliance audits, and faster, safer deployments, all while maintaining full visibility and control over their digital infrastructure.
VMblog: Can you outline a typical customer implementation journey? What critical pain points do you resolve, and what outcomes do clients achieve?
Ridelius: A typical customer journey often begins with a complex, heterogeneous environment facing the challenge of crypto migration. For example, moving to post-quantum cryptography (PQC). Organizations struggle with disparate systems, version sprawl, and varying manufacturer support, making it nearly impossible to swap all cryptography at once.
Keyfactor addresses this with a full-stack, crypto-agile approach that includes:
1. Discovery – identifying all cryptographic assets and dependencies (CipherInsights and InfoSec Global)
2. Triage – prioritizing risks and plan migration (Risk Intelligence)
3. Reissuance – issuing new, quantum-safe certificates (EJBCA)
4. Deployment and tracking – rolling out certificates and monitoring usage (Command)
5. Signing – sign applications, containers, and firmware (Signum/SignServer)
By following this journey, clients achieve resilient, quantum-ready infrastructure, compliance alignment, and continuous trust across all endpoints, even in the most complex enterprise environments.
VMblog: How does your technology fit within the broader CNCF ecosystem? What’s your role in the modern cloud-native infrastructure stack?
Ridelius: Keyfactor’s technology provisions secure, non-forgeable identities to cloud workloads from a trusted enterprise PKI, enabling organizations to enforce zero trust across their cloud-native infrastructure. Within the broader CNCF ecosystem, we complement Kubernetes and related projects by providing cryptographic controls, identity management, and compliance capabilities that native tools alone don’t cover. Our solutions help developers and platform teams secure workloads, orchestrate signing, and maintain trust across complex, hybrid, or multi-cloud environments, making us a critical component of a modern, resilient cloud-native stack.
VMblog: What are the biggest obstacles to Kubernetes adoption and scaling in 2025? How does your solution help organizations overcome these barriers?
Ridelius: While there are many challenges to Kubernetes adoption and scaling, one of the most critical is establishing zero trust from the very start. For organizations seeking to use autonomous agents, this must be established before deploying the first agent. Without this foundation, organizations will struggle with auditability, compliance, and secure management of machine identities-issues that only become more complex as deployments grow.
Keyfactor helps organizations overcome these barriers by enabling enterprises to provision trusted identities, enforce zero-trust policies, and manage certificates and signing operations across their cloud-native infrastructure. By embedding these controls early, teams can scale Kubernetes confidently, with full visibility, compliance alignment, and secure workflows from day one.
VMblog: What’s your take on the convergence of security-by-design and cloud-native development in 2025? How do you help customers implement secure-by-default practices?
Ridelius: By using SPIFFE certificates issued from EJBCA, organizations can enforce zero trust, ensuring that only authorized parties can communicate within a cloud environment. Combined with a service mesh like Istio, which enforces “always verify, never implicitly trust” mutual TLS between containers, workloads and agents are seamlessly provisioned with identity-first security. This approach provides verifiable, auditable access records and protects data in transit without modifying application code or container images.
Keyfactor enables this secure-by-default posture in cloud-native environments, a capability that becomes increasingly critical in the Agentic AI era, where workloads are dynamic, unpredictable, and demand continuous cryptographic assurance.
VMblog: Looking ahead to 2026 and beyond, how do you see the cloud-native landscape transforming? What should enterprises be strategically planning for?
Ridelius: With the rise of containerized AI agents, cloud workloads are becoming far more dynamic and unpredictable. Where workloads once performed pre-defined tasks using credentials in predictable ways, intelligent agents now introduce both new capabilities and new attack vectors. This shift makes zero trust more critical than ever.
Looking forward, enterprises should be strategically planning for robust authentication and authorization schemes that can scale with an increasingly agentic workforce. Ensuring that every workload, human or machine, operates with verifiable identity and least-privilege access will be a key enabler of secure growth and innovation.
VMblog: What emerging technologies or industry shifts is your company monitoring most closely as we head into 2026?
Ridelius: As we approach 2026, several emerging technologies and industry shifts are reshaping how organizations think about digital trust, identity, and cryptographic security: AI agents, shorter TLS lifespans, quantum computing, and rising compliance pressure stand out as the most impactful disruptors.
AI Agents:
As AI agents move from experimental tools to autonomous actors within enterprise environments, their ability to make decisions and interact with sensitive systems raises a fundamental question: can we trust the agent itself? Keyfactor is following the emerging market of AI agents, and reinforcing that agents are just another workload, and every workload needs a unique identity.
Traditional credentials like API keys and tokens are easily compromised and offer little visibility. To establish trust at scale, organizations must adopt cryptographic identity and certificate-based authentication, extending Zero Trust principles to ensure every agent is verifiable, accountable, and operating within defined policies. Certificates are the most robust, dynamic, and trustworthy method for authenticating AI agents, and PKI is the framework behind this.
Shorter TLS Lifespans:
With TLS certificate lifespans set to shrink to just 47 days by 2029, the way organizations manage digital certificates is undergoing a major shift. While shorter lifespans reduce exposure to compromise, they also increase operational demands, requiring more frequent renewals and tighter controls. In 2026, automated discovery, issuance, and rotation are no longer optional, but essential to maintaining uptime and digital trust.
Quantum Computing:
Quantum computing may not yet be a direct threat, but its potential to break widely used encryption is forcing organizations to act now. Adversaries are already capturing encrypted data, anticipating the ability to decrypt it in the future. Preparing for this “Q-day” means identifying vulnerable algorithms, gaining visibility into cryptographic assets, and building the agility to transition to post-quantum standards with minimal disruption.
Compliance Pressure:
The regulatory landscape around digital identity, encryption, and data protection is evolving rapidly, with a growing focus on machine identities and cryptographic governance. Whether it’s new AI regulations, emerging post-quantum standards, or updated frameworks like NIS2 or PCI-DSS 4.0, organizations will face increasing pressure to prove not just compliance, but continuous control over their trust infrastructure.
VMblog: What creative booth experiences, prize draws, or community engagement activities have you planned to connect with attendees?
Ridelius: Attendees who visit Keyfactor’s booth can enter for their chance to win a Nintendo Switch!
