Certificate-based authentication

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

Certificate-based authentication verifies an identity using a signed digital certificate presented by the requesting client.

Certificate-based authentication verifies a Kubernetes user by having the API server validate a signed X.509 client certificate stored in a kubeconfig file. Kubernetes’s built-in certificate authority signs the certificate, which the client presents with API requests to prove identity. section 3.1

Use the authentication method that matches the requester:

• Human requests made with kubectl commonly use client certificates or external identity providers and map to usernames. section 3.1
• Pod-to-API requests commonly use Service Account tokens rather than user client certificates. section 3.1
• Authentication precedes authorization: after identity is established, RBAC determines whether the request is allowed. section 3.1

Figure 3.1 Using a certificate and token to access the Kubernetes API

Trace how a certificate and token reach the Kubernetes API during authentication. section 3.1

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes

Explains certificate storage, certificate authority signing, API presentation, and contrast with tokens and identity providers.

Examples

Uses kubectl access, a kubeconfig-held certificate, an API request, and a certificate-and-token access diagram.

What it assumes

Assumes familiarity with kubectl and the Kubernetes API while defining X.509 certificates, kubeconfig, and Service Accounts.

What you can do after

Evaluate whether Kubernetes requests use user certificates or pod Service Account tokens and distinguish authentication from authorization.

How it connects

Connects X.509 certificates with kubeconfig, certificate authorities, Kubernetes API, RBAC, Service Accounts, and bearer tokens.

liveBookmanning.com

Read Acing the Certified Kubernetes Administrator Exam, Second Edition on liveBook Get the book at manning.com

Related concepts

• X.509 certificateuses · An X.509 certificate is a standardized, digitally signed data structure that binds an identity to a public key and contains related metadata.
• authenticationkind of · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.