Topic starter
24/06/2026 9:14 pm
TL;DR: KubeCon Europe 2025 showed the cloud-native stack moving from building blocks to operating systems, with AI, workload identity, and policy-driven authorization converging around one problem: identity is now the control plane, not an afterthought, according to Cerbos. Treating services and AI agents as first-class identities is now a prerequisite for secure production systems.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Insights from KubeCon Europe 2025 - AI gets real, and identity gets serious”.
Key questions
Q: How should security teams preserve workload identity in Kubernetes monitoring setups?
A: Use persistent storage for registration state, stable naming through StatefulSets, and a deployment model that keeps the agent recognisable after pod recreation.
Q: Why do shared credentials and hardcoded RBAC become a problem in cloud-native systems?
A: They hide who is actually acting and make access decisions brittle when systems scale or change dynamically.
A: A tightly coupled model usually shows up when small policy changes require code changes, deployments, or manual edits across multiple services.
Practitioner guidance
- Standardize workload identities Assign a unique identity to each service, sidecar, scheduler, and AI workload so access decisions are tied to runtime actors rather than shared credentials.
- Externalize authorization policy Move access rules out of application code and cluster config so policy changes can be versioned, reviewed, and audited separately.
- Add traceability at every hop Log which non-human identity requested, approved, and executed each action so teams can reconstruct behaviour across the platform.
Bottom line: Cloud-native governance is shifting toward identity-first control, with workloads and AI systems treated as operational subjects rather than anonymous infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:19 am
Identity has moved from support function to control plane. The article captures a cloud-native reality that many programmes still understate: identity is no longer just about login, token issuance, or service-to-service trust. It is now the layer where workload behavior, policy, and auditability are enforced. For IAM and platform teams, that means identity architecture has to be treated as production infrastructure, not an administrative wrapper.
A few things that frame the scale:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
A question worth separating out:
Q: How should teams treat AI workloads that make autonomous decisions in production?
A: Treat them as operational actors that need runtime guardrails, traceability, and explicit policy boundaries before they can influence downstream actions. If an AI workload can persist state or trigger work, it should be governed like a first-class identity, not a detached application feature.
👉 Read our full editorial: KubeCon Europe 2025 shows identity becoming the control plane