6 — Admission Controllers

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

7 — API Server Security

The API server is the single choke point for every cluster interaction, so disabling anonymous-auth and turning on audit logging there closes more risk surface than hardening any individual workload.

1 — Authentication

Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.

2 — Authorization

Authorization modes configured on the API server are OR'd together and evaluated in sequence, so a single permissive authorizer overrides every stricter one you also enabled.

5 — kubeconfig

A kubeconfig keeps clusters, users, and contexts as three independent lists, which is why one merged file (via the KUBECONFIG env var) can cleanly mix-and-match many identities across many clusters.