The Kubernetes API is the interface for using Kubernetes control-plane orchestration beyond ordinary service management. It exposes Kubernetes resources and lets platform teams apply reconciliation and self-healing behavior to broader infrastructure capabilities. section 7.0
A platform can authorize access to Kubernetes resources by team membership, then extend the API so teams provision platform infrastructure through the same control-plane experience. Custom platform APIs can follow the same access model. section 7.3.1
The API supports a platform pattern that:
- Uses orchestration logic to correct resources that drift from desired state. section 7.0
- Connects resource access with authentication and authorization based on organizational teams. section 7.3.1
- Provides a path from Kubernetes resources to provisioned platform infrastructure and custom APIs. section 7.3.1
Platform access flow
A user authenticates through an identity provider integrated with GitHub. The provider obtains the user’s GitHub organization teams and returns secure access to platform infrastructure or custom API resources. section 7.3.1
Figure 7.8 For Epetech, we would like our IDP service to have built-in or easily configurable means of integrating with GitHub, requiring authentication through whatever means we have set up in GitHub. As a result of (1) successful authentication, we want the IDP to (2) get the list of all teams the user is a member of in our GitHub organization. Finally, we want to (3) return to the user a secure means of accessing the platform infrastructure or custom API resources.
Trace the authentication, team lookup, and secure-resource-access flow used to connect organizational identity with Kubernetes and custom platform APIs. section 7.3.1
