Kubernetes Security

Chapter 4. Authorization

In this chapter, we focus on authorization in Kubernetes—assigning permissions to users and applications and in turn enforcing those. Authorization in Kubernetes verifies whether a certain action (such as “list pods” or “create a secret”) is allowed by a certain user or application, and if it is allowed, performs that action or otherwise rejects it and potentially logs the attempt. We’re building on the concepts and flows presented in Chapter 3, so if you haven’t read that chapter yet, now is a good time.

Authorization Concepts

Kubernetes authorizes API requests by using the API server, evaluating the request attributes against the policies and subsequently allowing or denying the request. By default, permissions are denied, unless explicitly allowed by a policy. Conceptually, authorization in Kubernetes works as depicted in Figure 4-1.

Figure 4-1. Authorization concepts

The authorization flow is as follows:

1. The client’s request is authenticated. See “Authentication Concepts” for details on this step.

2. If the authentication was successful, the credentials are taken as one input of the authorization module.

3. The second input to the authorization module is a vector containing the request path, resource, verb, and namespace (and other secondary attributes).

4. If the user or application is permitted to execute a certain action on a certain resource, ...