# Kubernetes
All Kubernetes notes →1 — Authentication
Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.
2 — Authorization
Authorization modes configured on the API server are OR'd together and evaluated in sequence, so a single permissive authorizer overrides every stricter one you also enabled.
3 — RBAC
RBAC bindings are purely additive with no deny rule, so a subject's effective permissions are the union of every Role and ClusterRole granted across all its bindings, not just the narrowest one.
4 — Service Accounts
Every pod is auto-mounted a default ServiceAccount token whether it calls the API or not, which is why disabling automountServiceAccountToken is a low-cost baseline hardening step.
5 — kubeconfig
A kubeconfig keeps clusters, users, and contexts as three independent lists, which is why one merged file (via the KUBECONFIG env var) can cleanly mix-and-match many identities across many clusters.
6 — Admission Controllers
Admission runs in two strict phases — all mutating webhooks complete before any validating webhook fires — so validation always inspects the final, already-mutated object, never the raw request.
7 — API Server Security
The API server is the single choke point for every cluster interaction, so disabling anonymous-auth and turning on audit logging there closes more risk surface than hardening any individual workload.
8 — Secret Encryption
Secrets are only base64-encoded in etcd by default, not encrypted, so without an EncryptionConfiguration enabling envelope encryption (ideally via a KMS provider) anyone with etcd access reads them in plaintext.