Hello and welcome to this lecture on authentication in a Kubernetes cluster as we have seen already
the kubernetes cluster consists of multiple nodes physical/virtual and various components that work
together.
We have users like Administrators that access the cluster to perform administrative tasks
The developers that access to cluster to test or deploy applications we have end users who access the
applications deployed on the cluster and we have third party applications accessing the cluster for
integration purposes.
Throughout this section we will discuss how to secure our cluster by securing the communication between
internal components and securing management access to the cluster through authentication and authorization
mechanisms.
In this lecture our focus is on securing access to the kubernetes cluster with authentication mechanisms.
so we talked about the different users that may be accessing the cluster security of end users who access
the applications deployed on the cluster is managed by the applications themselves internally. So we
will take them out of our discussion. Our focus is on users access to the kubernetes cluster for administrative
purposes.
So we are left with two types of users. Humans, such as the Administrators and Developers and Robots such
as other processes/services or applications that requires access to the cluster. Kubernetes does
not manage user accounts natively it relies on an external source like a file with user details or certificates
or a third party identity service like LDAP to manage these users. And so you cannot create users
in a kubernetes cluster or view the list of users like this.
However in case of Service Accounts kubernetes can manage them.
You can create and manage service accounts using the Kubernetes API.
We have a section on service accounts exclusively where we discuss and practice more about service accounts.
For this section we will focus on users in kubernetes. All user access is managed by the API server. Weather
you are accessing the cluster through kubectl tool or the API directly,
all of these requests go through the kube api server. The kube-api server authenticates the requests before
processing it.
So how does the kube-api server authenticate?
There are different authentication mechanisms that can be configured.
You can have a list of username and passwords in a static password file, or usernames and tokens in
a static token file or you can authenticate using certificates.
And another option is to connect to third party authentication protocols like LDAP, Kerberos etc
We will look at some of these next let's start with static password and token files as it is the easiest
to understand.
Let's start with the simplest form of authentication.
You can create a list of users and their passwords in a csv file and use that as the source for user
information.
The file has three columns password user name and user I.D..
We then pass the file name as an option to the kube-api server. Remember the kube-api server service
and the various options we looked at earlier in this course.
That is where you must specify this option.
You must then restart the kube-api server for these options to take effect.
If you setup your cluster using the kubeadm tool, then you must modify the kube-apiserver POD definition
file. Kube-adm
tool will automatically restart the kube-api server once you update the file.
To authenticate using the basic credentials while accessing the API server specify the user and password
in a curl command like this.
In the csv file with the user details that we saw we can optionally have a fourth column with the group
details to assign users to specific groups similarly instead of a static password file.
You can have a static token file here instead of password you specify a token pass the token file as
an option token-auth-file to the kube-api server. While authenticating specify the token as an Authorization
bearer token to your requests like this.
That's it for this lecture.
Remember that this authentication mechanism that stores user names, passwords and tokens in clear text in
a static file is not a recommended approach as it is insecure.
But I thought this was the easiest way to understand the basics of authentication in Kubernetes.
Going forward we will look at other authentication mechanisms.
I also want to point out that if you were trying this out in a kubeadm setup you must also consider
volume mounts to pass in the auth file. Details about these are available in the article that follows.
And remember to set up authorization for the new users we will discuss about authorization later in
this course in the upcoming lectures.
we will discuss about Certificate based authentication and how the various components within the kubernetes cluster
are secured using certificates.