Try Kubernetes

Reference Documentation

Design docs, concept definitions, and references for APIs and CLIs.

Documentation for Kubernetes v1.5 is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date documentation, see the latest version.

Reference Documentation
Kubernetes Resource Types (New Docs Style)
Version 1.5
Kubernetes API (New Docs Style)
Version 1.5
Kubectl Commands (New Docs Style)
Version 1.5
Kubernetes API
Kubernetes API Overview
Accessing the API
Overview
Authenticating
Using Authorization Plugins
Using Admission Controllers
Managing Service Accounts
Kubernetes API Operations
Kubernetes API Definitions
Well-Known Labels, Annotations and Taints
Kubernetes API Swagger Spec
Autoscaling API
Autoscaling API Operations
Autoscaling API Definitions
Batch API
Batch API Operations
Batch API Definitions
Apps API
Apps API Operations
Apps API Definitions
Extensions API
Extensions API Operations
Extensions API Definitions
kubectl CLI
kubectl Overview
kubectl for Docker Users
kubectl Usage Conventions
JSONpath Support
kubectl Cheat Sheet
kubectl Commands
kubectl
kubectl annotate
kubectl api-versions
kubectl apply
kubectl attach
kubectl autoscale
kubectl certificate
kubectl certificate approve
kubectl certificate deny
kubectl cluster-info
kubectl cluster-info dump
kubectl completion
kubectl config
kubectl config current-context
kubectl config delete-cluster
kubectl config delete-context
kubectl config get-clusters
kubectl config get-contexts
kubectl config set-cluster
kubectl config set-context
kubectl config set-credentials
kubectl config set
kubectl config unset
kubectl config use-context
kubectl config view
kubectl convert
kubectl cordon
kubectl cp
kubectl create
kubectl create configmap
kubectl create deployment
kubectl create namespace
kubectl create quota
kubectl create secret docker-registry
kubectl create secret
kubectl create secret generic
kubectl create secret tls
kubectl create serviceaccount
kubectl create service clusterip
kubectl create service loadbalancer
kubectl create service nodeport
kubectl delete
kubectl describe
kubectl drain
kubectl edit
kubectl exec
kubectl explain
kubectl expose
kubectl get
kubectl label
kubectl logs
kubectl options
kubectl patch
kubectl port-forward
kubectl proxy
kubectl replace
kubectl rolling-update
kubectl rollout
kubectl rollout history
kubectl rollout pause
kubectl rollout resume
kubectl rollout status
kubectl rollout undo
kubectl run
kubectl scale
kubectl set
kubectl set image
kubectl set resources
kubectl taint
kubectl top
kubectl top node
kubectl top pod
kubectl uncordon
kubectl version
Superseded and Deprecated Commands
kubectl stop
Kubernetes Components
kube-apiserver
kube-controller-manager
kube-proxy
kube-scheduler
kubelet
Overview
Master-Node communication
TLS bootstrapping
Kubelet authentication/authorization
Glossary
Annotations
Daemon Sets
Deployments
Horizontal Pod Autoscaling
Images
Ingress Resources
Jobs
Names
Namespaces
Network Policies
Nodes
Persistent Volumes
Pet Sets
Pods
Pod Security Policies
Replica Sets
Replication Controller
Resource Quotas
Cron Jobs
Secrets
Security Context
Services
Service Accounts
Third Party Resources
Volumes
Kubernetes Design Docs
Kubernetes Architecture
Kubernetes Design Overview
Kubernetes Identity and Access Management
Kubernetes OpenVSwitch GRE/VxLAN networking
Security Contexts
Security in Kubernetes

Edit This Page

Kubelet authentication/authorization

Overview

A kubelet’s HTTPS endpoint exposes APIs which give access to data of varying sensitivity, and allow you to perform operations with varying levels of power on the node and within containers.

This document describes how to authenticate and authorize access to the kubelet’s HTTPS endpoint.

Kubelet authentication

By default, requests to the kubelet’s HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.

To disable anonymous access and send 401 Unauthorized responses to unauthenticated requests:

To enable X509 client certificate authentication to the kubelet’s HTTPS endpoint:

To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet’s HTTPS endpoint:

Kubelet authorization

Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is AlwaysAllow, which allows all requests.

There are many possible reasons to subdivide access to the kubelet API:

To subdivide access to the kubelet API, delegate authorization to the API server:

The kubelet authorizes API requests using the same request attributes approach as the apiserver.

The verb is determined from the incoming request’s HTTP verb:

HTTP verb request verb
POST create
GET, HEAD get
PUT update
PATCH patch
DELETE delete

The resource and subresource is determined from the incoming request’s path:

Kubelet API resource subresource
/stats/* nodes stats
/metrics/* nodes metrics
/logs/* nodes log
/spec/* nodes spec
all others nodes proxy

The namespace and API group attributes are always an empty string, and the resource name is always the name of the kubelet’s Node API object.

When running in this mode, ensure the user identified by the --kubelet-client-certificate and --kubelet-client-key flags passed to the apiserver is authorized for the following attributes:

Analytics

Create an Issue Edit this Page