Deep Dive: Auth SIG
summary
Kubernetes authentication and authorization internals get a line-by-line walk through the API server codebase showing the HTTP handler stack, context keys, requestInfo, and how Union authenticator and caching wrap x.509, header, OIDC, bearer and service account token checks. Authorization uses a tri-state authorizer with a delegating call via SubjectAccessReview to the API server and a concrete OpenShift case showing OAuth + RBAC, a buggy scope authorizer ordering issue and the pragmatic fix of relying on system:masters.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:41Outline
- 1:52Impersonation Layer
- 2:41Authentication Authorization Framework
- 3:52Example Code
- 9:46Build Handler Chain
- 10:09Authentication Audit Impersonation and Authorization
- 10:19Authentication Wrapper
- 11:06Authenticator Interfaces
- 12:36User Interface
- 16:01Request Authenticator
- 18:40Authenticating a Token
- 19:05Union Authenticator Handler
- 24:40Attributes Interface
- 26:57Union for Authorizers
- 27:52Authentication and Authorization
- 28:48Scope Authorizer
- 35:26Authentication with Firebase
related talks
41mKubernetes Auth and Access Control
36mSIG Auth Deep Dive
05mKubernetes API Explained
35mRBAC to the Future: Untangling Authorization in Kubernetes
01h 32mSIG Auth Update and Deep Dive
31mStrengthening Auth in Kubernetes: Image Pulling, DRA Admin Access & Pod Certificates
29mEverything Wrong with K8s Authentication and How We Worked Around It
37mSecuring Web Apps in Kubernetes Using Spring Authorization Server