The Kubernetes API server must identify the caller before it can check permissions.
The article follows that identity through the request path: external users, in-cluster workloads, service account tokens, projected volumes, JWT claims, TokenReview, and AWS IAM federation.
You will learn:
- how authentication differs from authorization
- why human users usually come from OIDC, certificates, webhooks, proxies, or static token files
- how pods authenticate with service accounts
- why TokenRequest and projected volumes replaced automatic long-lived token secrets
- what
sub, aud, iss, and exp tell you inside a JWT- how EKS IRSA uses projected tokens to federate with AWS IAM
- how TokenReview validates Kubernetes-issued tokens inside the cluster
Read the full article:
https://learnkube.com/authentication-kubernetes