You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: chapters/configuring_authentication_and_authorization.md
+87-78Lines changed: 87 additions & 78 deletions
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,95 @@
1
-
# Configuring Authentication and Authorization
2
-
Let us assume a scenario, where a cluster admin was asked to add a newly joined developer, John, to the cluster. He needs to create a configuration file for John and restrict him from accessing resources from other environments.
1
+
# Kubernetes Access Control: Authentication and Authorization
3
2
4
-
## Create namespace for a user(Optional)
3
+
In this lab you are going to,
5
4
6
-
Create the **dev** namespace if it has not been created already.
5
+
* Create users and groups and setup certs based authentication
6
+
* Create service accounts for applications
7
+
* Create Roles and ClusterRoles to define authorizations
8
+
* Map Roles and ClusterRoles to subjects i.e. users, groups and service accounts using RoleBingings and ClusterRoleBindings.
7
9
8
-
`dev-namespace.yml`
9
10
10
-
```
11
-
apiVersion: v1
12
-
kind: Namespace
13
-
metadata:
14
-
name: dev
15
-
labels:
16
-
name: dev
17
-
```
18
-
```
19
-
kubectl apply -f dev-namespace.yml
20
-
```
11
+
## How one can access the Kubernetes API?
12
+
13
+
The Kubernetes API can be accessed by three ways.
14
+
15
+
* Kubectl - A command line utility of Kubernetes
16
+
* Client libraries - Go, Python, etc.,
17
+
* REST requests
18
+
19
+
## Who can access the Kubernetes API?
20
+
21
+
Kubernetes API can be accessed by,
22
+
23
+
* Human Users
24
+
* Service Accounts
25
+
26
+
Each of these topics will be discussed in detail in the later part of this chapter.
27
+
28
+
## Stages of a Request
29
+
30
+
When a request tries to contact the API , it goes through various stages as illustrated in the image given below.
31
+
32
+
33
+
<sub>[source: official kubernetes site](https://kubernetes.io/docs/home/)</sub>
34
+
35
+
36
+
### Stage 1: Authentication
37
+
38
+
* Authentication operation checks whether the *user/service account* has the permission to talk to the api server or not.
39
+
* Authentication is done by the authentication modules which are configured with the api server.
40
+
* Cluster uses with one or more authentication modules enabled.
41
+
* If the request fails to authenticate itself, it will be served with **401 error**.
42
+
43
+
#### Authentication for Human Users
44
+
45
+
* Kubernetes uses **usernames** for access control.
46
+
* But it neither has an api object nor stores information about users in its data store.
47
+
* Users need to be managed externally by the cluster administrator.
48
+
49
+
#### Authentication for Service Accounts
50
+
51
+
* Unlike user accounts, service accounts are managed by Kubernetes.
52
+
**service accounts* are bound to specific namespaces.
53
+
* Credentials for *service Accounts* are stored as *secrets*.
54
+
* These secrets are mounted to pods when a deployment starts using the Service Account.
55
+
56
+
### Stage 2: Authorization
57
+
58
+
* After a request successfully authenticated, it goes through the authorization process.
59
+
* In order for a request to be authorized, it must consist following attributes.
60
+
* Username of the requester(User)
61
+
* Requested action(Verb)
62
+
* The object affected(Resource)
63
+
* Authorization is done by the following modules. Each of these modules has a special purpose.
64
+
* Attribute Based Access Control(ABAC)
65
+
* Role Based Access Control(RBAC)
66
+
* Node Authorizer
67
+
* Webhook module
68
+
* If a request is failed to get authorized, it will be served with **403 error**.
69
+
* Among these modules, RBAC is the most used authorizer while,
70
+
* ABAC is used for,
71
+
* Policy based, fine grained access control
72
+
* The caveat is api server has to be restarted whenever we define a ABAC policy
73
+
* Node Authorizer is,
74
+
* Enabled in all the worker nodes
75
+
* Grants access to kubelet for some of the resources.
76
+
* We have already talked about the user in detail. Now lets focus on **verbs** and **resources**
77
+
* We will talk about RBAC in detail in the later part
78
+
79
+
### Stage 3: Admission Control
80
+
* Admission control part is taken care of by the software modules that can modify/reject requests.
81
+
* Admission control is mainly used for fine-tuning access control.
82
+
* Admission control can directly act on the object being modified.
0 commit comments