Kubernetes access control in the enterprise

on YouTube ↗59m

" summary

Introduces concrete choices: uses OpenID Connect and client certs, implements a global auth proxy that forwards identity via impersonation headers, stores users/groups and policies as Kubernetes custom resources and runs RBAC controller loops to reconcile and revoke bindings, demos provisioning clusters on DigitalOcean and shows role differences between dev and prod. Claims Rancher is already in Rancher Labs deployments and cites 2000 20,000 installations, and the demo access control flow works as shown.

AI-written summary · about

" chapters (36)

1. 0:00Introduction
2. 0:44About the company
3. 3:00Authentication vs Authorization
4. 3:47Authentication mechanisms in Kubernetes
5. 4:32Kubernetes integrations
6. 6:11Client certificates
7. 8:13OpenID Connect
8. 8:51OpenID Connect flow
9. 9:39Prerequisites
10. 10:59Global Central Authentication Proxy
11. 15:13Back Row Based Access Control
12. 15:43API Driven Access Control
13. 17:22Why API Driven Access Control
14. 17:47Learning curve
15. 19:17Why is it important
16. 21:15What are namespaces
17. 22:11Using namespaces to separate teams
18. 22:47Multiple namespaces per team
19. 23:10Separate deployment stages
20. 24:29Multiple namespaces
21. 24:59User roles
22. 26:27How to configure a bug
23. 30:15Kubernetes manifest
24. 34:07Best practices
25. 35:25CI pipeline
26. 37:06Rancher software
27. 37:45Control pattern
28. 38:33Replica set
29. 39:05Global state scale
30. 40:05Custom API resources
31. 40:55Rancher Manager Cluster
32. 42:11Demo
33. 43:03Adding a second cluster
34. 44:56Creating roles
35. 45:53Authorization
36. 52:58Source control

" related talks

• 35mManaging RBAC Cross Multiple Kubernetes ClustersAlena Prokharchyk · KubeCon + CloudNativeCon China 2018
• 41mKubernetes Auth and Access ControlEric Chiang · KubeCon + CloudNativeCon North America 2016
• 33mHow the Basics Of Kubernetes Auth Scale For OrganizationsLeigh Capili · KubeCon + CloudNativeCon North America 2022
• 31mKubernetes RBAC Security: A Practical OverviewCarol Valencia · KCD Guatemala 2023
• 01h 59mBuilding Secure Kubernetes Clusters with Identity ManagementMarc Boorshtein · All Things Open 2020
• 35mSmarter Kubernetes Access Control: A Simpler Approach to AuthRob Scott · KubeCon + CloudNativeCon Europe 2019
• 32mStop giving root access and start securing your Kubernetes clusters insteadTiffany Jernigan · ContainerDays Conference 2024
• 33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and PermissionsTiffany Jernigan · CloudNativeSecurityCon North America 2023