KUBERNETES SECURITY FUNDAMENTALS: AUTHORIZATION

Summary from the TLDR InfoSec newsletter

Kubernetes handles authorization by utilizing multiple authorization providers in the cluster requested in the order specified to the kube-server as flags on startup. Each provider can explicitly approve or deny the request or respond with “no opinion.” If all providers respond “no opinion,” the request is denied. Providers include AlwaysAllow and AlwaysDeny, which allow or deny every request; Node Authorizer, which restricts the access of the kubelet user; Attribute-Based Access Controls (ABAC), which enables cluster-admins to define authorization rules based on the request's characteristics statically; Role-Based Access Controls (RBAC), which is the most commonly used provider and maps permissions to roles; and Webhook, which is widely used in cloud provider clusters like AKS, GKE, and EKS.