3 — RBAC
Purpose
[stub: rbac]
Metadata
| Author | Amit Singh |
| Scope | kubernetes |
Local graph
Linked from 2 notes
Infrastructure Platform Engineering
A book-shaped table of contents for infrastructure platform engineering: from infrastructure operations to self-service platforms, IaC foundations, Terraform/OpenTofu, cloud platform design, networking, identity, compute, storage, golden images, automation, governance, observability, reliability, enterprise platforms, anti-patterns, and MAANG interview prep — cross-linking existing sre/networks/kubernetes/patterns/internal-developer-platforms notes instead of duplicating them.
Kubernetes
A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.
Related notes
6 — Admission Controllers
Admission runs in two strict phases — all mutating webhooks complete before any validating webhook fires — so validation always inspects the final, already-mutated object, never the raw request.
7 — API Server Security
The API server is the single choke point for every cluster interaction, so disabling anonymous-auth and turning on audit logging there closes more risk surface than hardening any individual workload.
1 — Authentication
Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.
2 — Authorization
Authorization modes configured on the API server are OR'd together and evaluated in sequence, so a single permissive authorizer overrides every stricter one you also enabled.