2 — Authorization

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

6 — Admission Controllers

Admission runs in two strict phases — all mutating webhooks complete before any validating webhook fires — so validation always inspects the final, already-mutated object, never the raw request.

7 — API Server Security

The API server is the single choke point for every cluster interaction, so disabling anonymous-auth and turning on audit logging there closes more risk surface than hardening any individual workload.

1 — Authentication

Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.

5 — kubeconfig

A kubeconfig keeps clusters, users, and contexts as three independent lists, which is why one merged file (via the KUBECONFIG env var) can cleanly mix-and-match many identities across many clusters.