Kubernetes Security Concepts

Internal

• Kubernetes Concepts

Transport Security

• https://kubernetes.io/docs/reference/access-authn-authz/#transport-security

Service Account

Processes in containers inside pods can contact the API server, and they need an identity when doing so. A service account provides the identity for processes that run in a the pod. Processes will authenticate using the identity provided by the service account. By default, in absence of specific configuration, the pods will authenticate as the default service account in the namespace they are running in. A specific service account name can be specified in the pod manifest. Service accounts are rendered in logs using the following pattern: "system:serviceaccount:namespace:account-name (e.g. "system:serviceaccount:blue:default).

TODO:

• https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
• https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

Default Service Account

Each namespace comes with a default service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: default
secrets:
- name: default-token-dddkl

Service Account Operations

• Details about the Namespace's Default Service Account
• Assigning a Cluster Role to a Service Account

Role Based Access Control (RBAC)

Kubernetes Role Based Access Control (RBAC) Concepts