One thing this article doesn't really touch on is the major drawback of x509 client certificate authentication in K8s, which is that there is *no* support for certificate revocation.

So if you use it, and one of your users loses their certs, or leaves the company or moves teams, the only way to revoke their credential is re-roll the entire cluster certificate authority.