Kubernetes Authentication

https://kubernetes.io/docs/reference/access-authn-authz/authentication/

• EKS authentication: aws eks update-kubeconfig
• GKE authentication: gcloud container clusters get-credentials

Authentication options

• Certificates
• Bearer tokens
• Authenticating proxy
• OIDC
• Webhook authentication

See also: ~/.kube/config

Accounts

• Service accounts are users managed by the Kubernetes API. They are bound to specific namespaces, and created automatically by the API server or manually through API calls. Service accounts are tied to a set of credentials stored as Secrets, which are mounted into pods allowing in-cluster processes to talk to the Kubernetes API.
• Users: "normal" user accounts cannot be added via an API call, any user that presents a valid certificate signed by the cluster's certificate authority (CA) is considered authenticated.. Kubernetes determines the username from the common name field in the 'subject' of the cert (e.g., "/CN=your-user").

Authorization: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269

• A user store like Keystone or Google Accounts

• kubectl config set-credentials

Activities

• Access Kubernetes REST API using default token
• Authenticate to your Amazon EKS cluster (aws eks update-kubeconfig)

Related

• kubectl create serviceaccount
• aws-auth: kubectl edit configmap aws-auth
• gke-gcloud-auth-plugin
• kind: CertificateSigningRequest
• Kubernetes Authorization
• EKS Authentication
• kubectl create token
• Kubernetes RBAC

See also

• kubectl create serviceaccount
• Kubernetes Authentication, bearer tokens, certificate authentication, Service accounts, CertificateSigningRequest, aws-auth, EKS Authentication, kind: Config, gke-gcloud-auth-plugin
• Kubernetes security, OPA, EKS security, PSA, PSS, CKS, SecurityContext, containerSecurityContext, Trivy, KubeBench, Kubernetes Admission Controllers admissionregistration.k8s.io, Hardeneks, Gatekeeper (Kubernetes), kubernetes.io/enforce-mountable-secrets, Auditing, security context, readOnlyRootFilesystem, allowPrivilegeEscalation, kube-bench

https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes