WEBVTT 00:00.450 --> 00:06.690 Hello and welcome to this lecture on authentication in a Kubernetes cluster as we have seen already 00:06.870 --> 00:12.990 the kubernetes cluster consists of multiple nodes physical/virtual and various components that work 00:12.990 --> 00:13.950 together. 00:14.020 --> 00:19.250 We have users like Administrators that access the cluster to perform administrative tasks 00:19.260 --> 00:25.440 The developers that access to cluster to test or deploy applications we have end users who access the 00:25.440 --> 00:31.110 applications deployed on the cluster and we have third party applications accessing the cluster for 00:31.170 --> 00:32.540 integration purposes. 00:33.350 --> 00:40.010 Throughout this section we will discuss how to secure our cluster by securing the communication between 00:40.010 --> 00:46.490 internal components and securing management access to the cluster through authentication and authorization 00:46.490 --> 00:47.750 mechanisms. 00:47.750 --> 00:54.800 In this lecture our focus is on securing access to the kubernetes cluster with authentication mechanisms. 00:56.170 --> 01:03.400 so we talked about the different users that may be accessing the cluster security of end users who access 01:03.400 --> 01:10.530 the applications deployed on the cluster is managed by the applications themselves internally. So we 01:10.530 --> 01:18.770 will take them out of our discussion. Our focus is on users access to the kubernetes cluster for administrative 01:18.770 --> 01:19.970 purposes. 01:19.970 --> 01:27.110 So we are left with two types of users. Humans, such as the Administrators and Developers and Robots such 01:27.110 --> 01:34.760 as other processes/services or applications that requires access to the cluster. Kubernetes does 01:34.760 --> 01:43.040 not manage user accounts natively it relies on an external source like a file with user details or certificates 01:43.190 --> 01:50.060 or a third party identity service like LDAP to manage these users. And so you cannot create users 01:50.060 --> 01:54.260 in a kubernetes cluster or view the list of users like this. 01:54.350 --> 01:58.900 However in case of Service Accounts kubernetes can manage them. 01:59.000 --> 02:03.280 You can create and manage service accounts using the Kubernetes API. 02:03.350 --> 02:09.590 We have a section on service accounts exclusively where we discuss and practice more about service accounts. 02:11.170 --> 02:19.360 For this section we will focus on users in kubernetes. All user access is managed by the API server. Weather 02:19.380 --> 02:24.580 you are accessing the cluster through kubectl tool or the API directly, 02:24.580 --> 02:32.170 all of these requests go through the kube api server. The kube-api server authenticates the requests before 02:32.350 --> 02:33.210 processing it. 02:34.150 --> 02:37.050 So how does the kube-api server authenticate? 02:37.120 --> 02:41.040 There are different authentication mechanisms that can be configured. 02:41.080 --> 02:48.220 You can have a list of username and passwords in a static password file, or usernames and tokens in 02:48.220 --> 02:52.960 a static token file or you can authenticate using certificates. 02:53.020 --> 02:59.550 And another option is to connect to third party authentication protocols like LDAP, Kerberos etc 03:00.310 --> 03:07.710 We will look at some of these next let's start with static password and token files as it is the easiest 03:07.710 --> 03:09.320 to understand. 03:09.540 --> 03:12.010 Let's start with the simplest form of authentication. 03:12.150 --> 03:19.290 You can create a list of users and their passwords in a csv file and use that as the source for user 03:19.290 --> 03:20.700 information. 03:20.820 --> 03:26.010 The file has three columns password user name and user I.D.. 03:26.440 --> 03:33.180 We then pass the file name as an option to the kube-api server. Remember the kube-api server service 03:33.270 --> 03:36.760 and the various options we looked at earlier in this course. 03:36.780 --> 03:39.400 That is where you must specify this option. 03:39.450 --> 03:44.310 You must then restart the kube-api server for these options to take effect. 03:44.310 --> 03:50.070 If you setup your cluster using the kubeadm tool, then you must modify the kube-apiserver POD definition 03:50.070 --> 03:51.350 file. Kube-adm 03:51.360 --> 03:56.370 tool will automatically restart the kube-api server once you update the file. 03:57.540 --> 04:03.630 To authenticate using the basic credentials while accessing the API server specify the user and password 04:03.930 --> 04:06.240 in a curl command like this. 04:09.980 --> 04:16.040 In the csv file with the user details that we saw we can optionally have a fourth column with the group 04:16.070 --> 04:22.370 details to assign users to specific groups similarly instead of a static password file. 04:22.390 --> 04:29.950 You can have a static token file here instead of password you specify a token pass the token file as 04:29.950 --> 04:37.300 an option token-auth-file to the kube-api server. While authenticating specify the token as an Authorization 04:37.300 --> 04:39.660 bearer token to your requests like this. 04:42.300 --> 04:43.510 That's it for this lecture. 04:43.590 --> 04:49.950 Remember that this authentication mechanism that stores user names, passwords and tokens in clear text in 04:49.950 --> 04:54.390 a static file is not a recommended approach as it is insecure. 04:54.800 --> 04:59.380 But I thought this was the easiest way to understand the basics of authentication in Kubernetes. 04:59.580 --> 05:03.830 Going forward we will look at other authentication mechanisms. 05:04.010 --> 05:09.980 I also want to point out that if you were trying this out in a kubeadm setup you must also consider 05:10.220 --> 05:15.800 volume mounts to pass in the auth file. Details about these are available in the article that follows. 05:15.800 --> 05:22.210 And remember to set up authorization for the new users we will discuss about authorization later in 05:22.210 --> 05:25.120 this course in the upcoming lectures. 05:25.140 --> 05:30.870 we will discuss about Certificate based authentication and how the various components within the kubernetes cluster 05:30.990 --> 05:33.320 are secured using certificates.