Controlling access to the Kubernetes API is key to ensuring that your cluster
is not only secured but also can be used as a means to impart policy
and governance for all users, workloads, and components of your
Kubernetes cluster. In this chapter, we share how you can use
admission controllers and authorization modules to enable specific
features and how you can customize them to suit your specific needs.
Figure 17-1 provides insight on how and where admission
control and authorization take place. It depicts the end-to-end request
flow through the Kubernetes API server until the object, if accepted, is
saved to storage.
Figure 17-1. An API request flow
Admission Control
Have you ever wondered how namespaces are automatically created when you
define a resource in a namespace that doesn’t already exist? Maybe
you’ve wondered how a default storage class is selected? These changes
are powered by a little-known feature called admission controllers. In
this section, we take a look at how you can use admission controllers to implement Kubernetes best practices on the server side on behalf of the
user and how we can utilize admission control to govern how a
Kubernetes cluster is used.
What Are They?
Admission controllers sit in the path of the Kubernetes API server request flow and receive requests following the authentication and authorization ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
