Aembit Secrets Operator now delivers X.509-SVID certificates

September 17, 2026

Aembit Secrets Operator 1.34.358 and Aembit Secrets Operator Helm chart 1.34.358 are now available.

Secrets Operator now delivers X.509-SVID certificates to your Kubernetes workloads. When an AembitSecretRefreshSchedule sets credentialType: X509Svid, Secrets Operator generates a private key inside the cluster and obtains a signed certificate from Aembit. It writes both to a kubernetes.io/tls Secret that your workload uses for mutual TLS. See Deliver X.509-SVID certificates with Secrets Operator.

New X509Svid credential type: The Secret holds tls.crt with the signed certificate chain and tls.key with the private key. Secrets Operator sends Aembit only a certificate signing request, so the private key never leaves the cluster.
Automatic renewal: Secrets Operator refreshes the certificate before it expires.
TLS Secret type: X509Svid writes a kubernetes.io/tls Secret, while every other credential type writes a generic Secret, so switching a schedule to or from X509Svid deletes and recreates the target Secret. See Credential types and Secret data keys.

Tags:

← Back to changelog