Authentication and Authorisation in Kubernetes

 Authentication and Authorisation in Kubernetes:

Who wants to talk to kubernetes cluster??? Either a user or an application.

So if an user or application want to talk to kubernetes cluster, He needs auhentication and authorisation.


Authentication:

  • If an user needs to talk to k8 cluster, the authentication is provided by kubeconfig file
  • For example, if a user named admin wants to talk to k8 cluster, he needs kubernetes config file, the default location of this file is(~/.kube/config)
  • This file contains the information of 
    1.User 
    2.Cluster 
    3.Context
  • Generally admin user, manages who wants to communicate with cluster by creating seperate config files for each user(This is in theory in practice all the developers users the same admin config file,which he shares with all the developers with in the team, by editing namespace)
  • If any one want to authenticate to kube api server, he needs 3 things
    1.ca.crt(certificate of CA, local to the cluster)
    2.user.crt(User certificate signed by ca with hiscertificate and private key)
    3.user.key(private key of the user)
  • Similarly if an application wants authorization, it needs these 3 files which are provided by service accounts
  • Service accounts are used by applications to talk to cluster, when we create a service account an associated secret object is always created which contains details of 3 files.
  • When we create a namespace, 1 service account is always created with name default and its secret is also created with name default suffixed with randon string, which is used to talk to api server within the cluster.

Authorization:

  • For users or service accounts, authorization inside the cluster are managed by roles,rolebindings,clusterroles and clusterrolebindings
  • The scope of roles and rolebindings are within namespace and the scope of clusterroles and clusterrolebindings is within cluster to all namespaces that is the only difference
  • We will create set of roles which contains exacly 3 fileds
    1.apiGroups
    2.resources
    3.verbs  
  • we will rolebinding we list users who uses above roles.If we have large numner of users it is complex to manage,so in rolebindings we will specify group and add users to the group.
Note:Watch these videos 
  • Creating custom config file for deveoper to access k8 cluster(authentication) and creating roles and role bindings(authorizatiom) - video by meandopensource
  • Everything you need to know about service accounts: here

Comments

Post a Comment

Popular posts from this blog

Docker Imp points

  1. docker run -it <image> <any command like ls>  - It will start the container execute the command and stop the container.The status of the stopped container can be seen using docker ps -a 2. docker run -it --rm <image> <any command like ls> - It will do the same the same hing, but after stopping it will also kills the container 3. If we run an docker image without specifying -d(detached mode),then we will enter into container directly and if we exit the container will be stopped 4.If we run container in detached mode by specifying -d,as shown below image will run in background,we can connect to it using exec. Eg:$docker run -itd <image> 5. About user in docker file: - If we specify any user in dockerfile, all the commands will be executed by that user and in  the image that user is retained, i.e if you make a container out of it,we will get same user. - If we want to switch user,you can do so using another user instruction in docker file a...
Read more

Docker volumes backup and restore & Docker networks

 Backup and restore docker volumes Official link Youtube Best aricle for volumes backup and restoration Docker neworks: Network drivers: Network driver summary : Bridge network Official link : The default network used by docker if we do not specify any option is bridge network We can create our own bridge network, Containers on the default bridge network can only access each other by IP addresses, unless you use the --link option , which is considered legacy. On a user-defined bridge network, containers can resolve each other by name or alias. We can create bridge network as shown below      $docker network create <network name>   If we don't specify any network driver then by default it is bridge and we can define subnet and default gateways by using different flagsf we can add container to user defined network 2 ways While creating docker container from image using --network or --net flag        $docker run --it --net=<network na...
Read more