7 — API Server Security

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

6 — Admission Controllers

Admission runs in two strict phases — all mutating webhooks complete before any validating webhook fires — so validation always inspects the final, already-mutated object, never the raw request.

1 — Authentication

Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.

2 — Authorization

Authorization modes configured on the API server are OR'd together and evaluated in sequence, so a single permissive authorizer overrides every stricter one you also enabled.

5 — kubeconfig

A kubeconfig keeps clusters, users, and contexts as three independent lists, which is why one merged file (via the KUBECONFIG env var) can cleanly mix-and-match many identities across many clusters.