Security Authorization

Question 1

What kind of Authorization is supported by Kubernetes?

Answer 1

• Node
• Attribute based access control
• role based access control
• webhook

Question 2

What is Node Authorization?

Answer 2

• Node Authorizer handels communication from kubelet with the kube apiserver
• everyone part of the SYSTEM:NODES group is handled by the node authorizer
• access within the cluster

Question 3

What is Attribute based Authorization?

Answer 3

• a user or a group of users receives a set of permissions
• i.e. dev-user can view/create/delete pods
• implemented through a policy file, with a set of policies defined in a JSON format
• that file is passed into the kube apiserver

{"kind": "Policy", "spec": {"user": "dev-user", "namespace": "*", "resource": "pods", "apiGroup": "*"}}

Question 4

What is a disadvantage of the abac approach?

Answer 4

• difficult to manage
• everytime something changes, the files need to be manually changed and the kube apiserver restarted

Question 5

What is Role based Authorization?

Answer 5

• a role is created with a set of permissions required for that role
• then the users/groups are associated with that role
• whenever a change needs to be made, only the role needs to be changed

Question 6

What is Webhook Authorization?

Answer 6

• used for authorization through external/third party solutions
• kubernetes makes an api request to the open policy agent with information about the user and his access requirement

Question 7

What additional Authorization Modes are available?

Answer 7

• always allow
• always deny

-> no authorization checks are applied

Question 8

How do you set the Authorization mode?

Answer 8

via –authorization-mode=…
on the kube api server

If not specified, set to always allowed

Question 9

How many Authorization modes can be set for a kube apiserver?

Answer 9

Multiple modes in comma separated list

Question 10

What happens, when you have multiple authrization modes configured for a kuber apiserver?

Answer 10

• request is authorized using each mode, in the specified order
• whenever a module denies a request, the request is forwarded to the next one in the chain
• as soon as a module approves the request no more checks are done