With no built-in solutions for managing user accounts, Kubernetes has to rely on external systems for this. Can we use one UAA solution for both Cloud Foundry and Kubernetes authentication while building a hybrid deployment?

1. @altoros

2. @altoros@altoros
Fire Exit Announcement
• Please note the locations of the surrounding emergency exits &
located the nearest lit EXIT sign to you
• In the event of a fire alarm or other emergency, please calmly
exit to the public concourse area
• Emergency exit stairwells leading to the outside of thisfacility
are located along the public concourse
• For your safety in an emergency, please follow the directions of
the Public Safety Staff

3. UAA Authentication for Kubernetes
Andrei Krasnitski
Software Engineer,Altoros
@altoros

4. @altoros@altoros
Talk Outline
• Authentication in Kubernetes
• Authorization in Kubernetes
• Demo
• Benefits
• Resources

5. @altoros@altoros
Kubernetes
• Open-source container orchestration platform
• Multi-cloud support
• Containers based
• Extensible API

6. @altoros@altoros
What isAuthentication and Authorization
• Authentication (AuthN) - determining the identity of auser,
server, or client.
• Authorization (AuthZ) - determining whether that user,
server, or client as permission to do something.

7. @altoros@altoros
AuthN and AuthZ consumers in Kubernetes
• Operators (using kubectl command-line tool)
• Internal communication:
• Pods
• Control Plane (apiserver, controller, scheduler etc.)

8. @altoros@altoros
Access Control Diagram
Authentication
User
Pod
Authorization Admission
Control
Kubernetes
API Server

9. @altoros@altoros
Authentication Strategies in Kubernetes
• X509 Client Certificates
• Static Password File
• Tokens:
• Static Token File
• Bootstrap Tokens
• Service Account Tokens
• OpenID Connect Tokens
• Webhook Tokens

10. @altoros@altoros
AuthN Plugins: X509 Client Certificates

11. @altoros@altoros
AuthN Plugins: Static Password/Token

12. @altoros@altoros
AuthN Plugins: Service Accounts

13. @altoros@altoros
AuthN Plugins: Webhook Token
End User
Auth
Service
Bearer Token Review Status

14. @altoros@altoros
OpenID Connect AuthN Plugin
• Delegate authentication of users to a trusted IdP.
• Extension for OAuth 2.0.
• “OpenID Connect 1.0 is a simple identity layer on top of
the OAuth 2.0 protocol. It allows Clients to verify the
identity of the End-User based on the authentication
performed by an Authorization Server, as well as to obtain
basic profile information about the End-User in an
interoperable and REST-like manner.”

15. @altoros@altoros
JSON Web Token
eyJhbGciOiJSUzI1NiIsImtpZCI6ImtleS0xIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmNDJlNjAxYi1mO
DBlLTQwMGMtOTU4Yy0xYWI0YThhZGNhNDQiLCJwcmV2aW91c19sb2dvbl90aW1lIjoxNTIz
NTQ5NDY5NDk1LCJ1c2VyX25hbWUiOiJhZG1pbiIsIm9yaWdpbiI6InVhYSIsImFtciI6WyJwd2
QiXSwiaXNzIjoiaHR0cHM6Ly91YWEuc3lzLnBjZi0xLTEyLmluZnJhLXJlZC54eXovb2F1dGgvdG
9rZW4iLCJjbGllbnRfaWQiOiJwb3J0YWwiLCJhdWQiOlsicG9ydGFsIl0sInppZCI6InVhYSIsImd
yYW50X3R5cGUiOiJwYXNzd29yZCIsInVzZXJfaWQiOiJmNDJlNjAxYi1mODBlLTQwMGMtOT
U4Yy0xYWI0YThhZGNhNDQiLCJhenAiOiJwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiXSwiY
XV0aF90aW1lIjoxNTIzNjU4NjA4LCJleHAiOjE1MjQ4NjgyMDgsImlhdCI6MTUyMzY1ODYwO
CwianRpIjoiMTRjMDBmNjk2ZWE5NGMzNmEzOTIxZDkxNTA2MDkyNjciLCJlbWFpbCI6ImFk
bWluIiwicmV2X3NpZyI6IjQ1N2U4Y2QwIiwiY2lkIjoicG9ydGFsIn0.rUK2FdC6ha1HAmNH_YC6
z6JzpJfTBuTqejIWfak37cApO1ij8_VCXaI51g3IXJrEvx3tcvxGRQdXr 88L1_iz7NjWYwqWVK_
VSmf6njR-k5S9UJkIx5WV6B-I_VCnHZsJCvGdYcll6Jkhf-
CTMWqL8mdpoRR6GQV_6iFUDLJtJq2c8LoXH2njm6-gi5iEu_lFxsh_IJUdjHP98mWwrRpf-
nZHpllJ12npkorhyY2g4hftgGNTm3o8GYtsn8IUPHPCfTFhtukEmjXB-
A1nODF2QHNO5tGlyBnryvo3TjUPy7NR96zzTnbAakSjh3iJkE_6Cy6Wll3GRXXYIsykXd5A

16. @altoros@altoros
Payload component of the JWT

17. @altoros@altoros
OpenID Connect Identity Providers
• Public:
• Google
• Microsoft
• Yahoo
• PayPal
• Amazon
• Self-hosted:
• dex
• UAA

18. @altoros@altoros
What is UAA
• User Account and Authorization server
• OAuth2 server
• SAML, LDAP and OpenID Connect integration
• Supports APIs for user account management
• APIs defined by the specs for OAuth2 and OpenID Connect

19. @altoros@altoros
How Does it Work with Kubernetes?
User kubectl
Identity
Provider
API Server
Login to IdP
IdP provide access_token
and id_token Call kubectl using
provided id_token Send token in Authorization
header to the API server
Validate JWT
signature
Check id_token
expiration date
UserAuthorized?
Send response to kubectl
Send result to the user

20. @altoros@altoros
Authorization Modules in Kubernetes
• Node (kubelets only)
• ABAC (Attribute-based access control)
• RBAC (Role-based access control)
• Webhook

21. @altoros@altoros
ABAC Overview

22. @altoros@altoros
ABAC Overview

23. @altoros@altoros
RBAC Overview
• Role an ClusterRole
• RoleBinding and ClusterRoleBinding
• User and Group

24. @altoros@altoros
RBAC and ABAC comparison
RBAC ABAC
Authorization policy changes can
be made using kubectl
command-line tool.
Requires SSHand file system
access on Kubernetes Master to
make changes in authorization
policy file.
Changes are applied on the fly. Operator must restart API server
to pickup new policy.
Authorization is managed by
Kubernetes API.
Authorization is managed by
user-configured local file.

25. Demo
@altoros

26. @altoros@altoros
Configure OpenID Connect in Kubernetes
Just configure additional flags on the API server:
• --oidc-issuer-url=URL
• --oidc-client-id=ID
• --oidc-username-claim=email
• --oidc-ca-file=/k8s-ca.em

27. @altoros@altoros
OpenID Connect in kubo-release
It’s already there:

28. @altoros@altoros
Lessons Learned
• Use one solution for Cloud Foundry and Kubernetes
• OpenID Connect includes discovery
• Easy to configure
• Minimize password security risks

29. @altoros@altoros
Get Involved!
• Repos:
• https://github.com/cloudfoundry-incubator/kubo-release
• https://github.com/cloudfoundry-incubator/kubo-deployment
• https://github.com/frodenas/uaa-k8s-oidc-helper
• Slack:
• Cloud Foundry #cfcr
• Kubernetes #sig-auth

30. Questions?
Andrei Krasnitski
Software Engineer,Altoros
@altoros