Docker & Kubernetes · Module 12

Kubernetes Access Control – Authentication, RBAC, Admission

Follow a request to the API server through three gates: authentication, authorization with RBAC, and admission controllers before it is stored in etcd.

Practice interactively →

What you will learn

• Describe the authentication → authorization → admission flow
• Tell normal users from ServiceAccounts and know the authentication methods
• Compare authorization modes and check permissions with `kubectl auth can-i`
• Create Roles and RoleBindings and understand admission controllers

Lessons

1. API Access Flow and Authentication

   Every request to kube-apiserver passes authentication, authorization and admission; Kubernetes only manages ServiceAccounts, normal users come from outside.

2. Authorization Modes

   After authentication the apiserver asks Node, ABAC, RBAC and Webhook modules in turn; the first one to decide wins, and if nobody allows the request it is denied.

3. RBAC — Roles, ClusterRoles and Bindings

   Roles/ClusterRoles define permissions, RoleBindings/ClusterRoleBindings grant them to subjects; the binding decides the scope.

4. Admission Controllers

   Admission runs after authentication and authorization, before the object is stored; mutating controllers change objects, validating ones accept or reject.