How to configure authorization for the cluster…

Configuring authentication in Kubernetes involves several components:

Authentication: Who are you?
Authorization: What are you allowed to do?
Admission Control: Additional checks before applying changes.

Authentication: Kubernetes supports various authentication methods:

x509 Certificates: The most common method.
Static Tokens (Bootstrap Tokens).
Service Account Tokens.
Various plugins like OpenID Connect (OIDC), Webhook Token Authentication, and others.

Example of creating a certificate for a user:

# Generate a private key for user alice
openssl genrsa -out alice.key 2048
# Create a CSR (Certificate Signing Request)
openssl req -new -key alice.key -out alice.csr -subj "/CN=alice/O=devs"
# Sign the CSR with a Certificate Authority (CA)
# Requires access to the CA's private key and certificate
# In production, it's preferable to use certificate management tools
# or integrate with an existing PKI

Authorization: The most widely used authorization mechanism in Kubernetes is Role-Based Access Control (RBAC). RBAC allows defining what actions (verbs) users or groups can perform on specific resources within certain namespaces or at the cluster level.

Main components of RBAC:

Role: Defines a set of access rules within a namespace.
ClusterRole: Defines a set of access rules at the cluster level.
RoleBinding: Binds a Role to a user, group, or ServiceAccount within a namespace.
ClusterRoleBinding: Binds a ClusterRole to a user, group, or ServiceAccount at the cluster level.

Example of creating a Role and RoleBinding:

# role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""] # Means "core" API group (resources like pods, services)
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]

# rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: default
subjects:
- kind: User
  name: alice # Username from the authentication request
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader # Name of the Role from role.yaml
  apiGroup: rbac.authorization.k8s.io

Applying the manifests:

kubectl apply -f role.yaml
kubectl apply -f rolebinding.yaml

Admission Control: Admission Controllers intercept requests to the Kubernetes API server after authentication and authorization but before the object is stored in etcd. They can perform additional checks, modify the requested objects, or reject them entirely.

Important Admission Controllers for security:

AlwaysPullImages: Ensures kubelet always pulls the image during startup regardless of whether a local image with the same tag exists.
LimitRanger: Enforces resource usage limits (CPU, memory, storage) for Pods and PersistentVolumeClaims within a namespace.
ResourceQuota: Sets maximum resource consumption for a namespace.
PodSecurityStandards: Enforces security policies for pods. Newer Kubernetes versions use Pod Security Admission.
MutatingAdmissionWebhook: Allows external webhooks to modify objects before they are saved.
ValidatingAdmissionWebhook: Allows external webhooks to validate objects before they are saved.

Configuring these components depends on specific security and infrastructure requirements. It is recommended to use a secret manager for managing certificates and keys. For centralized user and group management, Kubernetes can be integrated with external identity providers like LDAP, Active Directory, or OIDC-based IdPs.

How to configure authorization for the cluster?