Confirmation and approval in Red Hat OpenShift and Microservices frameworks

Security stands out as a fundamental aspect of a structure based on containers. The requirements for authentication and authorization are essential components within this framework. Let’s delve into how these processes function in Kubernetes and Red Hat OpenShift. The intricate interplay between various layers of a Kubernetes ecosystem, comprising the infrastructure layer, Kubernetes layer, and the layer of containerized applications, will be discussed.

Definition of authentication and authorization

Authentication in a computer system essentially aims to answer the question, “Who are you?”, while authorization seeks to determine, “Now that I know it’s you, what can you do?” Understanding these concepts in Kubernetes may be challenging due to the numerous components—users, APIs, containers, pods—interacting with each other. It’s crucial to clarify which components are involved, whether it’s authenticating to the Kubernetes cluster, a microservice accessing another microservice, a cloud resource outside the cluster, or an endpoint trying to interact with applications running on the cluster.

Authentication and approval with OAuth 2.0 and OIDC

Consider a scenario where a user attempts to reach an endpoint. This user could be an actual person or a non-human account, while the endpoint could be an API, a piece of software like a database, or a physical/virtual server. When a request from the user reaches the endpoint, the system must determine the sender’s identity (authentication) and what actions the user is permitted to perform (authorization).

Authentication technologies like LDAP, SAML, and Kerberos are available, with OAuth 2.0 and OpenID Connect (OIDC) emerging as popular methods for API authentication. While OAuth 2.0 manages access to resources using access tokens, OIDC extends this framework to include an identity layer. The protocol enables users to grant or deny access to specific user information, providing enhanced security.

Role-Based Access Control (RBAC)

RBAC plays a pivotal role in regulating access to network or computer resources based on individual user roles within an organization. For instance, a system administrator may have broad permissions across an entire infrastructure, while a regular user may only modify specific applications. Implementing RBAC ensures that each user’s level of access aligns with their role within the organization.

Transport Layer and Endpoints

Transport Layer Security (TLS) is a widely used mechanism for securely communicating with Kubernetes endpoints, providing an encrypted connection for HTTPS traffic. In scenarios involving Linux or Windows servers, SSH or RDP protocols are commonly employed to establish secure connections between users and endpoints. Similarly, TLS serves as the standard transport protocol when interacting with APIs, software, or SaaS platforms.

Layers of Access in Kubernetes and OpenShift

Understanding the authentication, authorization, and transport layers in a Kubernetes setup becomes simpler when segmented into three primary layers: the infrastructure layer, Kubernetes layer, and containerized applications layer. Each layer necessitates authentication and authorization capabilities to function seamlessly within the overall system.

Authentication and Authorization in Infrastructure Layer

Users in the infrastructure layer, often system administrators, rely on various authentication mechanisms to access specific components like storage, networking, or compute resources. Whether connecting to servers via SSH interfaces or managing applications on OpenShift, administrators encounter diverse authentication and authorization mechanisms tailored to the specific layer they are interacting with.

Authentication and Authorization in OpenShift

Moving up the layers into the OpenShift domain requires interacting with the Kubernetes API server, obliging human and non-human users to authenticate via an OAuth2 server. Accounting for factors like supported identity providers during server configuration is vital for successful user authentication. Once authenticated, users obtain OAuth access tokens, facilitating their interactions with the OpenShift API until the tokens expire or are revoked.

Authentication and Authorization for Users and Service Accounts

In the OpenShift realm, users can assume various roles, from regular users to system users or non-human entities like service accounts. Effective group management simplifies authorization policies and permissions, enabling organizations to assign access privileges to user groups collectively instead of individually to streamline access control.

Role-Based Access Control (RBAC) and Authorization

Upon successful authentication, users are granted access privileges based on RBAC permissions, which determine user actions on specific resources. Managing RBAC involves defining rules, roles, and bindings, allowing organizations to enforce cluster-wide or project-specific access controls within their Kubernetes environment.

OpenShift offers predefined roles and a comprehensive RBAC framework illustrated by the OpenShift documentation to guide users in implementing tailored access controls.

Authentication and Authorization of Resources within OpenShift Layer

Resources within the Kubernetes layer, such as pods, often require access to interact with the Kubernetes API, underlying infrastructure, or external resources like cloud platforms. Employing security context constraints and other tools facilitates fine-grained control over pod permissions, ensuring that each resource interacts securely within the OpenShift environment.

Authentication and Authorization for Containerized Applications in OpenShift

Containerized applications in the OpenShift environment may need to access APIs, external resources, or non-API endpoints. Leveraging service accounts, Kubernetes Secrets, and environment variables, containers can securely interact with the Kubernetes API and external services, fostering a robust authentication and authorization framework within the containerized application layer.

Conclusion

Authentication and authorization form the bedrock of secure interactions within Kubernetes and OpenShift environments. By delineating these processes across various layers and employing robust access control mechanisms, organizations can maintain stringent security standards within their containerized architectures.

Acknowledgments to Shane Boulden and Derek Waters for their invaluable contributions to this discourse. Source: Red Hat Blog.