Understanding how Kubernetes knows who you are

In the 1999 sci-fi film The Matrix, Neo talks to a child about the Matrix as he waits to see the Oracle. The child explains to him that the trick to manipulating the Matrix is to realize that “There is no spoon.”

This is a great way to look at users in Kubernetes because they don’t exist. With the exception of service accounts, which we’ll talk about later, there are no objects in Kubernetes called “User” or “Group.” Every API interaction must include enough information to tell the API server who the user is and what groups the user is a member of. This assertion can take different forms, depending on how you plan to integrate authentication into your cluster.

In this section, we will get into the details of the different ways Kubernetes can associate a user with a cluster.

External users

Users who access the Kubernetes API from outside the cluster will usually do...