Managing cluster access

Requests from a cluster's users, either humans or service accounts, need to go through authentication and authorization stages before hitting the API server and manipulating the required Kubernetes objects. A typical request goes through three access stages before it gets either allowed or rejected:

Figure 6.1 – Kubernetes access stages

The request has to go through the authentication stage to verify the client's identity by any of the mechanisms supported by Kubernetes, then it goes through the authorization stage to verify which actions are allowed for this user, and finally it goes through the admission controller stage to decide whether any modifications need to be made. You will learn about each of these in the following subsections.

Cluster authentication

Kubernetes cluster users need to successfully authenticate into the cluster to access its objects. However, normal cluster users, such as developers and...