API security big picture
All of the following make CRUD-style requests to the API server (create, read, update, delete):
- Operators and developers using
kubectl - Pods
- Kubelets
- Control plane services
- Kubernetes-native apps
Figure 14.1 shows the flow of a typical API request passing through the standard checks. The flow is the same, no matter where the request originates.
Consider a quick example where a user called grant-ward is trying to create a Deployment called hive in the terran Namespace.
User grant-ward issues a kubectl apply command to create the Deployment in the terran Namespace. The kubectl command-line tool generates a request to the API server with the user’s credentials embedded. The connection between kubectl and the API server is secured by TLS. As soon as the request reaches the API server, the authentication module determines whether the request originates from grant-ward or an imposter. Assuming it is grant-ward...
