Topic starter
17/08/2026 4:39 pm
TL;DR: Teleport argues that cloud-native security is shifting toward identity as the control plane, as KubeCon Europe 2025 discussions centered on securing humans, workloads, CI/CD pipelines, AI services, and SSH access with short-lived, auditable identity instead of static credentials. The central change is that infrastructure governance now depends on verifying who or what is acting at runtime, not just hardening the resource itself.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “KubeCon Europe 2025: Why Identity is the New Backbone of Secure Infrastructure”.
By the numbers:
- Over 70% of the sessions touched on AI or machine learning workloads.
Key questions
Q: How should security teams implement runtime security for ephemeral cloud workloads?
A: Security teams should treat runtime security as a live control plane, not a pre-deployment check.
Q: Why do static secrets increase risk in DevOps pipelines?
A: Static secrets remain valid far beyond the task that needed them, which creates a wider window for theft, reuse, and privilege escalation.
Q: What are the signs that privileged infrastructure access is poorly governed?
A: Common signs include unmanaged admin interfaces, inconsistent ownership of firewall or router consoles, direct internet exposure, and patch state that is tracked separately from privileged access records.
Practitioner guidance
- Map all infrastructure access paths Inventory human logins, SSH access, CI/CD credentials, service accounts, and workload-to-workload authentication in one control view so the same actor is not governed by multiple disconnected models.
- Replace static secrets in pipelines Move build and deploy jobs to short-lived certificates or identity assertions so pipelines do not carry reusable keys that outlive the task they were created for.
- Bind privileged sessions to identity context Require an authenticated identity provider, a named resource, and an expiry window for SSH, kubectl, database, and admin access so access events stay attributable.
Bottom line: Cloud-native security now depends on governing runtime identity across humans, workloads, pipelines, and automation, not treating access as a separate concern.
What's in the full article
Teleport's full post covers the operational detail this analysis intentionally leaves for the source:
- How Teleport applies short-lived certificates to SSH, kubectl, and database access in mixed infrastructure
- Examples of the platform engineer, SRE, and DevOps access problems discussed at KubeCon Europe 2025
- How the product handles CI/CD key sprawl and secrets replacement in workflow-heavy environments
- The specific access workflow used to unify multi-cloud infrastructure under one identity layer
👉 Read Teleport's analysis of identity as the control plane for secure infrastructure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Identity is now the governing plane for cloud-native infrastructure: the question is no longer whether a cluster is secure in isolation, but whether every action inside it is tied to a verifiable actor. That shifts the centre of gravity from perimeter and resource controls to runtime identity governance across humans, workloads, and automation. Practitioners should treat identity as the coordination layer that makes zero trust operational in distributed environments.
A few things that frame the scale:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
A question worth separating out:
Q: How do teams balance least privilege with developer speed in cloud-native platforms?
A: Use just-in-time access with policy-controlled expiry so engineers can get the access they need for a defined task without keeping standing privilege. The key is to make temporary access easy to request, auditable, and scoped to one resource or workflow, so speed comes from orchestration rather than permanent entitlements.
👉 Read our full editorial: Identity is becoming the control plane for secure infrastructure