Security - Authentication, Authorization, Admission Control

Question 1

What questions are to be made about the kube-apiserver in terms of security?

Answer 1

• Who can access?
• What can they do?

Question 2

How is Authentication in kube-apiserver dealt with?

Answer 2

• Files: Username and PWs
• Files: Username and Tokens
• Certificates
• External Authentication providers - LDAP
• Service Accounts

Question 3

What Authorization mechanisms exists for kube-apiserver?

Answer 3

• Role-based access controls (RBAC) Authorization
• Attribute based access controls (ABAC)
• Node Authorization
• Webhook mode

Question 4

Where is TLS encryption used?

Answer 4

• between kube-apiserver and all other components
• like schedulers, controllers, Kubelet, kube-proxy, etcd

Question 5

How is user (admins, devs) access managed in Kubernetes?

Answer 5

• managed by kube-apiserver
• it authenticates request
• afterwards processes it

Question 6

What Auth-mechanisms can be configured for the kube-apiserver?

Answer 6

• static password file (username + pw)
• static token fole (username + token)
• certificates
• Identity Services (third party)

Question 7

How does static password file authentication work? (Basic)

Answer 7

• create a list of users and their password in a csv file
• source for user information
• parts: pw,username,userid
• optionally fourth column: group1
• the file can be passed as on option (–) to the kube-apiserver:
• –basic-auth-file=user-details.csv
• then the kube-apiserver needs to be restarted

Question 8

How can you authenticate yourself in a curl command?

Answer 8

with ‘-u “user1:password123”’

Question 9

How does Authentication with a static token file work?

Answer 9

• like with a static password file
• four parts:
• token,username,userid,group

Question 10

How can you pass a token-file to the kube-apiserver?

Answer 10

–token-auth-file=user-token-details.csv

Question 11

How do you authenticate while communicating with the kube-apiserver

Answer 11

in curl command:
‘–header “Authorization: Bearer < token>”’