Kubernetes Authentication and Authorization Flow

Kubernetes Authentication and Authorization Flow An architecture diagram generated by Archify. Requester · User / Service Account · Architecture component Requester User / Service Account Authentication · AuthN · Architecture component Authentication AuthN Authorization · AuthZ · Architecture component Authorization AuthZ Admission Control · Admission plugins · Architecture component Admission Control Admission plugins API Server · kube-apiserver · Architecture component API Server kube-apiserver X.509 Certificates · Client certs · Authentication Methods X.509 Certificates Client certs SA Token · Service Account JWT · Authentication Methods SA Token Service Account JWT OpenID Connect · External IdP · Authentication Methods OpenID Connect External IdP Webhook Token Auth · Remote token check · Authentication Methods Webhook Token Auth Remote token check RBAC · Role-based · Authorization Modes RBAC Role-based ABAC · Attribute-based · Authorization Modes ABAC Attribute-based Node · Node authorizer · Authorization Modes Node Node authorizer Webhook · External service · Authorization Modes Webhook External service Authentication Methods Authorization Modes

Authentication Methods

  • • X.509 Certificates: authentication using client certificates
  • • Service Account Tokens: JWT tokens associated with service accounts
  • • OpenID Connect (OIDC): authentication through external identity providers
  • • Webhook Token Authentication: token verification through external services
  • • Authentication Proxy: request processing through an authentication proxy

Authorization Modes

  • • RBAC: role-based access control (most common)
  • • ABAC: attribute-based access control
  • • Node: node authorization
  • • Webhook: authorization through external services