Towards a Standardized Identity-based Authorization in Kubernetes
Talkat CNCF Maintainer Summit Europe 2025 · on Monday, 2025-03-31· at 15:20· Level 3 | ICC Capital Suite 14-16·
summary
Argues Kubernetes should shift east‑west policies from IP/label rules to identity‑based authorization, citing NetworkPolicy v1 limits (implicit deny, IP/label fragility, scalability and eventual‑consistency bugs) and Cluster/AdminNetworkPolicy CRDs that add deny/priorities but still use IPs. Compares Cilium’s label‑to‑identity and mesh/service‑account approaches, surfaces open problems: identity derivation, encoding, transport across L3/L4/TLS/L7, CNI vs mesh composition, and leveraging KEP cap‑4317 for kubelet‑issued identities. Proposes API tradeoffs, no final implementation yet.
AI-written summary · about
chapters (10)
- 0:00Identity-based auth in Kubernetes
- 3:09East-west authorization in Kubernetes
- 7:43Limitations of network policies
- 11:57Need for identity-based policies
- 13:03Building identity-based policies
- 16:37Existing implementations
- 18:24Scope of entities for identity policies
- 20:13Policy enforcement challenges
- 23:23Future standardization directions
- 25:09Q&A
related talks
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
36mNetwork-independent ACLs: Why Security Shouldn't Depend on Your Network
35mRBAC to the Future: Untangling Authorization in Kubernetes
40mKubernetes Networking Panel: Collaborate on the Spec, Compete on Execution
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
33mIdentity and Access Management in Kubernetes
24mAll-or-Nothing No More: Taming Kubernetes Impersonation With Granular Controls