Uploaded byAltoros
UAA for Kubernetes
The document discusses emergency exit procedures and provides an outline for a talk on authentication and authorization in Kubernetes. It covers various authentication strategies, including the use of OpenID Connect and JWTs, and compares RBAC and ABAC for authorization management. It also highlights the importance of using a unified solution across platforms like Cloud Foundry and Kubernetes, with resources for further involvement.
More Related Content
UAA for Kubernetes
- 1.
- 2. @altoros@altoros Fire Exit Announcement •Please note the locations of the surrounding emergency exits & located the nearest lit EXIT sign to you • In the event of a fire alarm or other emergency, please calmly exit to the public concourse area • Emergency exit stairwells leading to the outside of thisfacility are located along the public concourse • For your safety in an emergency, please follow the directions of the Public Safety Staff
- 3. UAA Authentication forKubernetes Andrei Krasnitski Software Engineer,Altoros @altoros
- 4. @altoros@altoros Talk Outline • Authenticationin Kubernetes • Authorization in Kubernetes • Demo • Benefits • Resources
- 5. @altoros@altoros Kubernetes • Open-source containerorchestration platform • Multi-cloud support • Containers based • Extensible API
- 6. @altoros@altoros What isAuthentication andAuthorization • Authentication (AuthN) - determining the identity of auser, server, or client. • Authorization (AuthZ) - determining whether that user, server, or client as permission to do something.
- 7. @altoros@altoros AuthN and AuthZconsumers in Kubernetes • Operators (using kubectl command-line tool) • Internal communication: • Pods • Control Plane (apiserver, controller, scheduler etc.)
- 8. @altoros@altoros Access Control Diagram Authentication User Pod AuthorizationAdmission Control Kubernetes API Server
- 9. @altoros@altoros Authentication Strategies inKubernetes • X509 Client Certificates • Static Password File • Tokens: • Static Token File • Bootstrap Tokens • Service Account Tokens • OpenID Connect Tokens • Webhook Tokens
- 10. @altoros@altoros AuthN Plugins: X509Client Certificates
- 11. @altoros@altoros AuthN Plugins: StaticPassword/Token
- 12.
- 13. @altoros@altoros AuthN Plugins: WebhookToken End User Auth Service Bearer Token Review Status
- 14. @altoros@altoros OpenID Connect AuthNPlugin • Delegate authentication of users to a trusted IdP. • Extension for OAuth 2.0. • “OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.”
- 15. @altoros@altoros JSON Web Token eyJhbGciOiJSUzI1NiIsImtpZCI6ImtleS0xIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmNDJlNjAxYi1mO DBlLTQwMGMtOTU4Yy0xYWI0YThhZGNhNDQiLCJwcmV2aW91c19sb2dvbl90aW1lIjoxNTIz NTQ5NDY5NDk1LCJ1c2VyX25hbWUiOiJhZG1pbiIsIm9yaWdpbiI6InVhYSIsImFtciI6WyJwd2 QiXSwiaXNzIjoiaHR0cHM6Ly91YWEuc3lzLnBjZi0xLTEyLmluZnJhLXJlZC54eXovb2F1dGgvdG 9rZW4iLCJjbGllbnRfaWQiOiJwb3J0YWwiLCJhdWQiOlsicG9ydGFsIl0sInppZCI6InVhYSIsImd yYW50X3R5cGUiOiJwYXNzd29yZCIsInVzZXJfaWQiOiJmNDJlNjAxYi1mODBlLTQwMGMtOT U4Yy0xYWI0YThhZGNhNDQiLCJhenAiOiJwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiXSwiY XV0aF90aW1lIjoxNTIzNjU4NjA4LCJleHAiOjE1MjQ4NjgyMDgsImlhdCI6MTUyMzY1ODYwO CwianRpIjoiMTRjMDBmNjk2ZWE5NGMzNmEzOTIxZDkxNTA2MDkyNjciLCJlbWFpbCI6ImFk bWluIiwicmV2X3NpZyI6IjQ1N2U4Y2QwIiwiY2lkIjoicG9ydGFsIn0.rUK2FdC6ha1HAmNH_YC6 z6JzpJfTBuTqejIWfak37cApO1ij8_VCXaI51g3IXJrEvx3tcvxGRQdXr88L1_iz7NjWYwqWVK_ VSmf6njR-k5S9UJkIx5WV6B-I_VCnHZsJCvGdYcll6Jkhf- CTMWqL8mdpoRR6GQV_6iFUDLJtJq2c8LoXH2njm6-gi5iEu_lFxsh_IJUdjHP98mWwrRpf- nZHpllJ12npkorhyY2g4hftgGNTm3o8GYtsn8IUPHPCfTFhtukEmjXB- A1nODF2QHNO5tGlyBnryvo3TjUPy7NR96zzTnbAakSjh3iJkE_6Cy6Wll3GRXXYIsykXd5A
- 16.
- 17. @altoros@altoros OpenID Connect IdentityProviders • Public: • Google • Microsoft • Yahoo • PayPal • Amazon • Self-hosted: • dex • UAA
- 18. @altoros@altoros What is UAA •User Account and Authorization server • OAuth2 server • SAML, LDAP and OpenID Connect integration • Supports APIs for user account management • APIs defined by the specs for OAuth2 and OpenID Connect
- 19. @altoros@altoros How Does itWork with Kubernetes? User kubectl Identity Provider API Server Login to IdP IdP provide access_token and id_token Call kubectl using provided id_token Send token in Authorization header to the API server Validate JWT signature Check id_token expiration date UserAuthorized? Send response to kubectl Send result to the user
- 20. @altoros@altoros Authorization Modules inKubernetes • Node (kubelets only) • ABAC (Attribute-based access control) • RBAC (Role-based access control) • Webhook
- 21.
- 22.
- 23. @altoros@altoros RBAC Overview • Rolean ClusterRole • RoleBinding and ClusterRoleBinding • User and Group
- 24. @altoros@altoros RBAC and ABACcomparison RBAC ABAC Authorization policy changes can be made using kubectl command-line tool. Requires SSHand file system access on Kubernetes Master to make changes in authorization policy file. Changes are applied on the fly. Operator must restart API server to pickup new policy. Authorization is managed by Kubernetes API. Authorization is managed by user-configured local file.
- 25.
- 26. @altoros@altoros Configure OpenID Connectin Kubernetes Just configure additional flags on the API server: • --oidc-issuer-url=URL • --oidc-client-id=ID • --oidc-username-claim=email • --oidc-ca-file=/k8s-ca.em
- 27. @altoros@altoros OpenID Connect inkubo-release It’s already there:
- 28. @altoros@altoros Lessons Learned • Useone solution for Cloud Foundry and Kubernetes • OpenID Connect includes discovery • Easy to configure • Minimize password security risks
- 29. @altoros@altoros Get Involved! • Repos: •https://github.com/cloudfoundry-incubator/kubo-release • https://github.com/cloudfoundry-incubator/kubo-deployment • https://github.com/frodenas/uaa-k8s-oidc-helper • Slack: • Cloud Foundry #cfcr • Kubernetes #sig-auth
- 30.