Notes / tag / authn-authz

#authn-authz

8 notes

1 — Authentication

Kubernetes has no built-in user database — every request is authenticated by delegating identity checks to external mechanisms like X.509 client certs, OIDC tokens, or webhook callouts.

kubernetes authn-authz book

2 — Authorization

Authorization modes configured on the API server are OR'd together and evaluated in sequence, so a single permissive authorizer overrides every stricter one you also enabled.

kubernetes authn-authz book

3 — RBAC

RBAC bindings are purely additive with no deny rule, so a subject's effective permissions are the union of every Role and ClusterRole granted across all its bindings, not just the narrowest one.

kubernetes authn-authz book

4 — Service Accounts

Every pod is auto-mounted a default ServiceAccount token whether it calls the API or not, which is why disabling automountServiceAccountToken is a low-cost baseline hardening step.

kubernetes authn-authz book

5 — kubeconfig

A kubeconfig keeps clusters, users, and contexts as three independent lists, which is why one merged file (via the KUBECONFIG env var) can cleanly mix-and-match many identities across many clusters.

kubernetes authn-authz book

6 — Admission Controllers

Admission runs in two strict phases — all mutating webhooks complete before any validating webhook fires — so validation always inspects the final, already-mutated object, never the raw request.

kubernetes authn-authz book

7 — API Server Security

The API server is the single choke point for every cluster interaction, so disabling anonymous-auth and turning on audit logging there closes more risk surface than hardening any individual workload.

kubernetes authn-authz book

8 — Secret Encryption

Secrets are only base64-encoded in etcd by default, not encrypted, so without an EncryptionConfiguration enabling envelope encryption (ideally via a KMS provider) anyone with etcd access reads them in plaintext.

kubernetes authn-authz book