Authorization

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

Authorization is the process of determining which actions an authenticated subject may perform on protected resources.

After a request is authenticated, authorization determines which Kubernetes API actions its user, group, or Service Account may perform. RBAC uses roles and role bindings to control access to resources. section 3.1 section 9.3.2

Choose the permission scope that matches the task:

• Use Roles for permissions within a namespace, and bind them to users, groups, or Service Accounts. section 9.3.2
• Use ClusterRoles for cluster-wide permissions, and bind them to users, groups, or Service Accounts. section 9.3.2

Restricting access to pods

A user can be limited to viewing pods; a role can also allow listing pods in the kube-system namespace. section 3.1 section 9.3.2

Figure 3.3 The RBAC mechanism uses roles and role bindings to prevent unauthorized requests from accessing the Kubernetes API and persisting in etcd.

Use the diagram to trace how RBAC roles and bindings restrict requests to the Kubernetes API. section 3.1

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes

Links authentication to RBAC permissions and identifies roles and bindings as access controls.

Examples

Demonstrates listing kube-system pods and limiting a user to viewing pods.

What it assumes

Assumes API requests authenticate first and distinguishes certificate-authenticated users from Service Account-authenticated pods.

What you can do after

Configure permissions for users, groups, and Service Accounts using roles and bindings.

How it connects

Connects authentication, RBAC, roles, role bindings, Service Accounts, and the Kubernetes API.

liveBookmanning.com

Read Acing the Certified Kubernetes Administrator Exam, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionAuthorization is the process of determining and enforcing what an authenticated identity is permitted to access or do.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionAuthorization is the process of determining whether an authenticated entity has permission to perform an action or access a resource.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eAuthorization is the process of determining whether an authenticated subject has permission to perform an operation or access a resource.
• 

  liveBookmanning.com
  Secure APIsAn access authorization control determines which authenticated subjects are permitted to perform particular actions on protected resources.
• 

  liveBookmanning.com
  Architecting an Apache Iceberg LakehouseAccess control is the restriction of data or system operations to authorized users or services according to defined permissions.
• 

  liveBookmanning.com
  Generative AI in ActionAccess control is the practice of restricting access to systems, resources, or data according to identity, policy, or authorization.
• 

  liveBookmanning.com
  .NET in Action, Second EditionAuthorization is the process of determining which actions or resources an authenticated or anonymous principal is permitted to access.
• 

  liveBookmanning.com
  Django in ActionAuthorization is the process of determining which actions or resources an authenticated user is permitted to access.
• 

  liveBookmanning.com
  Build AI-Enhanced Web AppsAuthorization is the process of determining which authenticated users or principals are permitted to access resources or perform actions.
• 

  liveBookmanning.com
  Apache Kafka in ActionAccess control is the enforcement of rules that determine which principals may access particular data or perform particular operations.
• 

  liveBookmanning.com
  Grokking Relational Database DesignThe restriction of data or system operations according to the permissions granted to users or processes.
• 

  liveBookmanning.com
  Amazon Web Services in Action, Third Edition: An in-depth guide to AWSAuthorization is the process of determining whether an authenticated identity may perform a requested action on a resource.
• 

  liveBookmanning.com
  ScyllaDB in ActionAuthorization is the process of determining whether an authenticated identity has permission to perform a requested operation.
• 

  liveBookmanning.com
  API Design PatternsAuthorization is the determination of whether an authenticated user is permitted to perform a requested operation.
• 

  liveBookmanning.com
  Data-Driven CybersecurityAuthorization is the process of determining and granting permitted access to resources or operations after an identity or entity has been established.
• 

  liveBookmanning.com
  Spring AI in ActionAuthorization is the determination of whether an authenticated subject has permission to perform a requested operation or access a resource.
• 

  liveBookmanning.com
  Kafka for ArchitectsAccess control is the enforcement of rules governing which subjects can access particular resources or data attributes.
• 

  liveBookmanning.com
  Grokking Web Application SecurityAccess control is the enforcement of rules governing which principals may access particular resources or perform particular actions.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkAuthorization is the process of determining which actions or resources an authenticated principal is permitted to access.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionAuthorization is the process of determining which actions or resources an authenticated entity is permitted to access.
• 

  liveBookmanning.com
  Terraform in Depth: Infrastructure as Code with Terraform and OpenTofuAuthorization is the process of determining which operations an authenticated identity is permitted to perform.
• 

  liveBookmanning.com
  AI for Everyday ITAccess control is the restriction and management of who or what may access systems, data, or resources and which actions they may perform.
• 

  liveBookmanning.com
  MongoDB 8.0 in Action, Third EditionAccess control is the enforcement of rules governing which identities may access resources or perform operations.
• 

  liveBookmanning.com
  Bootstrapping Microservices, Second Edition: With Docker, Kubernetes, GitHub Actions, and TerraformAuthorization is the process of determining which actions or resources an authenticated participant is permitted to access.
• 

  liveBookmanning.com
  WordPress Power Toolkit: Harness AI to build next-level websitesA permission is an authorization specifying an action that a person may or may not perform on a website or with protected content.
• 

  liveBookmanning.com
  Digital Twins in ActionAccess control is the restriction and authorization of access to resources or actions according to identities, roles, or policies.
• 

  liveBookmanning.com
  Kubernetes in Action, Second EditionA file permission is an access right specifying whether a user class may read, write, or execute a filesystem object.

Compare how 28 books explain authorization →

Related concepts

• authenticationcontrasts with · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• role-based access controlincludes · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
• principle of least privilegeconfigured by · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
• securityused by · The protection of systems, information, resources, and operations against unauthorized access, use, disclosure, alteration, disruption, or destruction.
• rolepart of · A role is a defined function, responsibility, perspective, or set of permissions associated with a participant in an organization or system.

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.