Overview of authentication and authorization

Glossary of common terms for OKD authentication and authorization

This glossary defines common terms that are used in OKD authentication and authorization.

authentication

An authentication determines access to an OKD cluster and ensures only authenticated users access the OKD cluster.

authorization

Authorization determines whether the identified user has permissions to perform the requested action.

bearer token

Bearer token is used to authenticate to API with the header Authorization: Bearer <token>.

Cloud Credential Operator

The Cloud Credential Operator (CCO) manages cloud provider credentials as custom resource definitions (CRDs).

config map

A config map provides a way to inject configuration data into the pods. You can reference the data stored in a config map in a volume of type ConfigMap. Applications running in a pod can use this data.

containers

Lightweight and executable images that consist software and all its dependencies. Because containers virtualize the operating system, you can run containers in a data center, public or private cloud, or your local host.

Custom Resource (CR)

A CR is an extension of the Kubernetes API.

group

A group is a set of users. A group is useful for granting permissions to multiple users one time.

HTPasswd

HTPasswd updates the files that store usernames and password for authentication of HTTP users.

Keystone

Keystone is an OpenStack project that provides identity, token, catalog, and policy services.

Lightweight directory access protocol (LDAP)

LDAP is a protocol that queries user information.

manual mode

In manual mode, a user manages cloud credentials instead of the Cloud Credential Operator (CCO).

mint mode

Mint mode is the default and recommended best practice setting for the Cloud Credential Operator (CCO) to use on the platforms for which it is supported. In this mode, the CCO uses the provided administrator-level cloud credential to create new credentials for components in the cluster with only the specific permissions that are required.

namespace

A namespace isolates specific system resources that are visible to all processes. Inside a namespace, only processes that are members of that namespace can see those resources.

node

A node is a worker machine in the OKD cluster. A node is either a virtual machine (VM) or a physical machine.

OAuth client

OAuth client is used to get a bearer token.

OAuth server

The OKD control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token.

OpenID Connect

The OpenID Connect is a protocol to authenticate the users to use single sign-on (SSO) to access sites that use OpenID Providers.

passthrough mode

In passthrough mode, the Cloud Credential Operator (CCO) passes the provided cloud credential to the components that request cloud credentials.

pod

A pod is the smallest logical unit in Kubernetes. A pod is comprised of one or more containers to run in a worker node.

regular users

Users that are created automatically in the cluster upon first login or via the API.

request header

A request header is an HTTP header that is used to provide information about HTTP request context, so that the server can track the response of the request.

role-based access control (RBAC)

A key security control to ensure that cluster users and workloads have access to only the resources required to execute their roles.

service accounts

Service accounts are used by the cluster components or applications.

system users

Users that are created automatically when the cluster is installed.

users

Users is an entity that can make requests to API.

About authentication in OKD

To control access to an OKD cluster, a cluster administrator can configure user authentication and ensure only approved users access the cluster.

To interact with an OKD cluster, users must first authenticate to the OKD API in some way. You can authenticate by providing an OAuth access token or an X.509 client certificate in your requests to the OKD API.

An administrator can configure authentication through the following tasks:

• Configuring an identity provider: You can define any supported identity provider in OKD and add it to your cluster.

• Configuring the internal OAuth server: The OKD control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token. You can configure the token duration and inactivity timeout, and customize the internal OAuth server URL.

  Users can view and manage OAuth tokens owned by them.

• Registering an OAuth client: OKD includes several default OAuth clients. You can register and configure additional OAuth clients.

  When users send a request for an OAuth token, they must specify either a default or custom OAuth client that receives and uses the token.

• Managing cloud provider credentials using the Cloud Credentials Operator: Cluster components use cloud provider credentials to get permissions required to perform cluster-related tasks.

• Impersonating a system admin user: You can grant cluster administrator permissions to a user by impersonating a system admin user.

About authorization in OKD

Authorization involves determining whether the identified user has permissions to perform the requested action.

Administrators can define permissions and assign them to users using the RBAC objects, such as rules, roles, and bindings. To understand how authorization works in OKD, see Evaluating authorization.

You can also control access to an OKD cluster through projects and namespaces.

Along with controlling user access to a cluster, you can also control the actions a pod can perform and the resources it can access using security context constraints (SCCs).

You can manage authorization for OKD through the following tasks:

• Viewing local and cluster roles and bindings.

• Creating a local role and assigning it to a user or group.

• Creating a cluster role and assigning it to a user or group: OKD includes a set of default cluster roles. You can create additional cluster roles and add them to a user or group.

• Creating a cluster-admin user: By default, your cluster has only one cluster administrator called kubeadmin. You can create another cluster administrator. Before creating a cluster administrator, ensure that you have configured an identity provider.

  After creating the cluster admin user, delete the existing kubeadmin user to improve cluster security.

• Creating service accounts: Service accounts provide a flexible way to control API access without sharing a regular user’s credentials. A user can create and use a service account in applications and also as an OAuth client.

• Scoping tokens: A scoped token is a token that identifies as a specific user who can perform only specific operations. You can create scoped tokens to delegate some of your permissions to another user or a service account.

• Syncing LDAP groups: You can manage user groups in one place by syncing the groups stored in an LDAP server with the OKD user groups.