What Do You Mean K8s Doesn't Have Users? How Do I Manage User Access Then?

on YouTube ↗28m

" summary

Kubernetes does not store or manage user accounts: authentication is external and the API server only receives a username string to feed into RBAC. Four practical auth options exist: client certificates are effectively unrevocable because the cluster CA stays static, static token file requires API server restart to change tokens, webhook token auth calls TokenReview to an external service for per-request validation, and use OpenID Connect with signed JWTs to tie existing identity providers into RBAC.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 2:00TRY TO REALIZE THE TRUTH
3. 2:47Topics • How AAA works in general
4. 3:30How AAA works in k8s API server • Every call to API is tied to
5. 5:34Two categories of identities • ServiceAccount For processes (pods)
6. 7:40User is a "transient" thing • User data not stored on etcd User info is "just a string"
7. 8:20Ways to identify a user • X509 certs
8. 8:52User identification - client certs • Control plane manages CA
9. 10:46Client cert - gothas (in a typical setup) • CA is static for the lifetime of cluster Other cluster components authenticating with client certs
10. 12:23User identification - token file • CSV file for user tokens
11. 13:25Token file - gotchas • Tokens loaded only at api-server boot • Tokens in plain text Tokens cannot be invalidated
12. 14:25User identification - Webhook Token Auth • External service validating
13. 16:39User identification - OIDC • api-server configured to trust
14. 19:08Comparison / Summary
15. 22:40Authorization • Can a user perform the action?
16. 23:54How to tie users into RBAC
17. 25:21Summary • User is a "transient" thing

" related talks

• 41mKubernetes Auth and Access ControlEric Chiang · KubeCon + CloudNativeCon North America 2016
• 33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and PermissionsTiffany Jernigan · CloudNativeSecurityCon North America 2023
• 33mHow the Basics Of Kubernetes Auth Scale For OrganizationsLeigh Capili · KubeCon + CloudNativeCon North America 2022
• 35mRBAC to the Future: Untangling Authorization in KubernetesJimmy Mesta · NDC Security 2023
• 31mKubernetes RBAC Security: A Practical OverviewCarol Valencia · KCD Guatemala 2023
• 19mAuditing Kubernetes Users: Tracking Security HolesCarol Valencia · KubeDay Colombia 2024
• 25mMastering K8s SecurityDeepu K Sasidharan · Conf42 DevSecOps 2024
• 45mBeyond cluster-admin: Getting Started with Kubernetes Users and PermissionsTiffany Jernigan · Devoxx France 2023