This document discusses user authentication and authorization in Kubernetes. It describes how Kubernetes uses external services like Active Directory and LDAP for user authentication. It also explains the different types of users in Kubernetes including normal users, service accounts, and how kubeconfig files are used. The main authorization mechanism in Kubernetes is Role-Based Access Control (RBAC) which uses roles and role bindings to control access to Kubernetes API resources and operations.

1. K8sOM#15
User Authentication and Authorization in
Kubernetes
Neependra Khare, CloudYuga

2. About the Speaker - Neependra Khare
● Founder and Principal Consultant at CloudYuga
● Author of Docker Cookbook - 2015
● Author of “Introduction to Kubernetes” course on Edx
● Running Docker Meetup Group in Bangalore, India
for more than 4 years now

3. Kubernetes Architecture
Controller
Scheduler
API Server
key/value
store
Master Node
Node
Kubelet
kube-proxy
Node
Kubelet
kube-proxy
Node
Kubelet
kube-proxy
CLI/API

4. Kubernetes API Request
Authenticaion
Can a user to login
to the cluster ?
Authorization
Can a user do
requested action ?
Admission
Control
Is it a valid request ?
K8s
objects

5. Authentication

6. Kubernetes Users
● Users are not first class citizen of Kubernetes, like Pods
● In most of the cases, it is offloaded to external services like Active
Directory, LDAP

7. Kubernetes Users
● Users are not first class citizen like Pods
● In most of the cases, it is offloaded to external services like Active
Directory, LDAP
Normal Users Service Accounts

8. Normal Users
● Basic Authentication
○ Pass a configutation with content like following to API Server
<password>,<username>,<uid>,"<group1,group2>"
<password>,<username>,<uid>,"<group1,group3>”
● X.509 Client Certificate
○ Create a user’s Public/Private key combination
○ Get it certified by a CA (Kubernetes CA)
● Bearer Tokens (JSON Web Tokens)
○ OpenID Connect
■ On Top of OAuth 2.0
○ Webhooks

9. Service Account
● Think of it as a user, using which a process inside a Pod can access
API Server.
● A Service Account with default name, gets created as we create a
new namesapce.
● User defined Service Accounts can be created as well, which we can
attach to the pod running in same namespace.

10. Kubeconfig File
apiVersion: v1
clusters:
- cluster:
certificate-authority: /Users/neependra/.minikube/ca.crt
server: https://192.168.99.100:8443
name: minikube
contexts:
- context:
cluster: minikube
user: minikube
name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: minikube
user:
client-certificate: /Users/neependra/.minikube/client.crt
client-key: /Users/neependra/.minikube/client.key
User dev Cluster devContext dev
User qa Cluster qaContext qa
User prod Cluster prodContext prod

11. Authentication Demo Workflow
nkhare.key
(openssl)
nkhare.csr
(openssl)
nkhare-csr
(k8s object)
nkhare.crt
K8s
CA

12. Authentication
Demo

13. Authorization

14. Kubernetes Authorization
Can a User do Requested Action ?

15. Kubernetes Authorization
Can a User do Requested Action ?
● Kubernetes Autorization Modules
○ AlwaysAllow
○ AlwaysDeny
○ Node
○ Attribute Based Access Control (ABAC)
○ Role Based Access Control (RBAC)
○ Webhook

16. Operations on Kubernetes Objects
● create
● get
● delete
● list
● update
● edit
● patch
● watch
● ….

17. Role Based Access Control (RBAC) - Roles
Role
“Applicable to a given namespace
only.”
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: cloudyuga
name: deployment-manager
rules:
- apiGroups: ["", "apps"]
resources: ["deployments", "replicasets", "pods"]
verbs: ["get", "list", "watch", "create", "update"]
ClusterRole
“Applicable Cluster Wide.”
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: deployment-manager-cluster
rules:
- apiGroups: ["", "apps"]
resources: ["deployments", "replicasets", "pods"]
verbs: ["get", "list", "watch", "create", "update"]

18. Kubernetes - APIs
/
/healthz /metrics /api /apis …..
/api/v1
/api/v1/pods /api/v1/nodes /api/v1/services ……
/apis/apps
/apis/apps/v1
/apis/apps/v1/Deployment /apis/apps/v1/DaemonSet /apis/apps/v1/StatefulSet …….
/apis/apps/v1beta1
/apis/…..

19. Role Based Access Control (RBAC) - Role Bindings
RoleBinding
“Applicable to a given namespace
only.”
ClusterRoleBinding
“Applicable Cluster Wide.”
Role
Subjects
- Normal Users
- Service Accounts
- Groups
ClusterRole
Subjects
- Normal Users
- Service Accounts
- Groups

20. Role Based Access Control (RBAC) - Role Bindings
RoleBinding
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: deployment-manager-binding
namespace: cloudyuga
subjects:
- kind: User
name: nkhare
apiGroup: "rbac.authorization.k8s.io"
roleRef:
kind: Role
name: deployment-manager
apiGroup: "rbac.authorization.k8s.io"
ClusterRoleBinding
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: cluster-manager-binding
subjects:
- kind: User
name: nkhare
apiGroup: "rbac.authorization.k8s.io"
roleRef:
kind: ClusterRole
name: deployment-manager-cluster
apiGroup: "rbac.authorization.k8s.io"

21. Authorization
Demo

22. Thanks
@neependra
https://www.linkedin.com/in/neependra/