Authentication and Security
Authentication and Security
Starting from cryptography basics, learn step by step in five groups, from PKI and TLS through Kubernetes certificate operations to various authentication methods (client certificates, Webhook, OIDC).
- Cryptography and Security Fundamentals — Keys, CA, PKI, TLS handshake
- K8s Security Architecture — Authentication/authorization, API Server plugins
- Certificate Management and Practice — Certificate locations, inspection, renewal
- Authentication Mechanism Labs — mTLS, Webhook
- Enterprise IAM Integration — OAuth 2.0, OIDC, Keycloak
1. Cryptography and Security Fundamentals (Foundation)
Learn about symmetric and asymmetric keys, the basic concepts of cryptography, to understand Kubernetes authentication methods.
Learn about Certificate Authorities (CAs) to understand the Kubernetes API server certificate.
Learn about Public Key Infrastructure (PKI) and X.509 certificates.
Learn about creating a CSR and the certificate request process for issuing certificates.
How SSL/TLS works and the hybrid encryption approach
A step-by-step explanation of how certificates guarantee secure communication.
2. K8s Security Architecture (Architecture)
Learn about authentication and authorization, the core concepts of Kubernetes security.
The three stages of API server request processing: authentication, authorization, and admission control
Kubernetes users fall into two kinds: human users (people) and machine users (machines/services).
3. Certificate Management and Practice (Operation)
A Kubernetes cluster acts as its own Root CA, issuing and managing all certificates inside the cluster.
Learn where certificates are stored in a Kubernetes cluster and how to manage them.
The key certificates and files kubeadm generates when initializing a cluster
Learn about the concept of Static Pods, their relationship with the API server, and how control plane components are started.
Inspect the information in the Root CA certificate and the certificate files used by the API Server in a Kubernetes cluster.
Hands-on practice verifying encryption using the public key of the Root CA certificate.
Check the certificate expiration dates of a Kubernetes cluster and learn about the kubeadm-config ConfigMap.
4. Authentication Mechanism Labs (Implementation)
Explains X.509 certificate-based authentication for securely connecting to the Kubernetes API server.
Learn about mutual TLS authentication (mTLS), the foundation of communication inside a Kubernetes cluster.
A lab on building a certificate-based environment so that a normal user (honggildong) can work only in their own Namespace.
Learn about the concept and characteristics of HTTP Basic Authentication (Basic Auth).
Learn about webhook token authentication in the Kubernetes API server.
A lab procedure for switching the Kubernetes API server authentication method to an external webhook server.
5. Enterprise IAM Integration (Advanced)
Practice managing and switching between multiple independent Kubernetes clusters with a single kubectl.
OAuth 2.0 is the most widely used authorization framework in modern web and mobile environments.
OpenID Connect (OIDC) is a modern authentication standard that adds an identity layer on top of the OAuth 2.0 protocol.
An introduction to and installation of Keycloak, an open-source IAM that implements OIDC/OAuth 2.0
A lab on integrating the Kubernetes API server with Keycloak, an external IAM solution, to enable OpenID Connect (OIDC) authentication.