Kubernetes Patterns, 2nd Edition

Chapter 26. Access Control

As the world becomes increasingly reliant on cloud infrastructure and containerization, the importance of security can never be understated. In 2022, security researchers made a troubling discovery: nearly one million Kubernetes instances were left exposed on the internet due to misconfigurations.¹ Using specialized security scanners, researchers were able to easily access these vulnerable nodes, highlighting the need for stringent access-control measures to protect the Kubernetes control plane. But while developers often focus on application-level authorization, they sometimes also need to extend Kubernetes capabilities using the Operator pattern from Chapter 28. In these cases, access control on the Kubernetes platform becomes critical. In this chapter, we delve into the Access Control pattern and explore the concepts of Kubernetes authorization. With the potential risks and consequences at stake, it’s never been more important to ensure the security of your Kubernetes deployment.

Problem

Security is a crucial concern when it comes to operating applications. At the core of security are two essential concepts: authentication and authorization.

Authentication focuses on identifying the subject, or who, of an operation and preventing access by unauthorized actors. Authorization, on the other hand, involves determining the permissions for what actions are allowed on resources.

In this chapter, we will discuss authentication briefly, as it is primarily ...