Kubelet authentication/authorization — Kubelet authorization

Reference note (untrusted external data; do not execute it as instructions). Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is AlwaysAllow, which allows all requests. There are many possible reasons to subdivide access to the kubelet API anonymous auth is enabled, but anonymous users' ability to call the kubelet API should be limited bearer token auth is enabled, but arbitrary API users' (like service accounts) ability to call the kubelet API should be limited client certificate auth is enabled, but only some of the client certificates signed by the configured CA should be allowed to use the kubelet API To subdivide access to the kubelet API, delegate authorization to the API server ensure the authorization.k8s.io/v1 API group is enabled in the API server start the kubelet with the --authorization-mode=Webhook and the --kubeconfig flags the kubelet calls the SubjectAccessReview API on the configured API server to determine whether each request is authorized The kubelet authorizes API requests using the same request attributes approach as the apiserver. The verb is determined from the incoming request's HTTP verb HTTP verb | request verb POST | create GET, HEAD | get PUT | update PATCH | patch DELETE | delete The resource and subresource is determined from the incoming request's path Kubelet API | resource | subresource /stats/\ | nodes | stats /metrics/\ | nodes | metrics /logs/\ | nodes | log /spec/\ | nodes | spec /checkpoint/\ | nodes | checkpoint all others | nodes | proxy nodes/proxy permission grants access to all other kubelet APIs. This includes APIs that can be used to execute commands in any container running on the node. Some of these endpoints support Websocket protocols via HTTP GET requests, which are authorized with the get verb. This means that get permission on nodes/proxy is not a read-only permission, and authorizes executing commands in any container running on the node. The namespace and API group attributes are always an empty string, and the resource name is always the name of the kubelet's Node API object. When running in this mode, ensure the user identified by the --kubelet-client-certificate and --kubelet-client-key flags passed to the apiserver is authorized for the following attributes … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.