Zero Trust Architecture in Kubernetes

Chapter 1. Authentication and Authorization

Zero trust is about making sure all data transmissions and interactions are authenticated at all possible vectors within your network. In order to deploy zero trust architecture (ZTA) for Kubernetes, we must understand how authentication and authorization work within the containerization platform.

A user in a Kubernetes cluster is defined as any user account that has authentication credentials and is granted a certificate that is controlled by either a human or a machine. A Kubernetes cluster can have two types of users: service accounts and normal users. Service accounts usually originate from within a Kubernetes-based system for use by internal services and are managed by Kubernetes; normal users are managed by an outside service. But because Kubernetes doesn’t have an object to represent normal user accounts, these accounts cannot be added to a cluster through an API call. A Kubernetes object is any entity that can be defined or configured with a YAML configuration file. I’ll expand on YAML configuration files in Chapter 3.

Authentication of Normal Users

You can set up Kubernetes to verify machine identities external to its cluster. Consumers will indirectly interact with machine identities (such as TLS certificates) wherever they go on the web, within and outside of Kubernetes. So external machine identity verification makes it possible for a consumer of your enterprise’s services to use your application securely.

Normal users ...