Newer documentation is now live.You are currently reading an older version.

Kubernetes CLI authentication flow

The following diagram illustrates the Kubernetes CLI authentication flow.

iam-authn-k8s

First, the Kubernetes API server obtains the Keycloak public key. Then, the CLI obtains JSON Web Tokens (JWTs) from Keycloak and uses them to access the Kubernetes API:

  1. The Kubernetes API server requests the OpenID public key of Keycloak.

  2. Keycloak sends its public key to the Kubernetes API server.

  3. kubectl sends an authentication request to kubelogin.

  4. kubelogin requests JWTs from Keycloak.

  5. Keycloak returns JWTs signed by its private key.

  6. kubectl sends a request to the Kubernetes API with the JWT.

  7. The Kubernetes API server verifies the JWT signature using the Keycloak public key.

  8. The Kubernetes API server verifies the JWT expiration date.

  9. The Kubernetes API server verifies the Role-Based Access Control (RBAC) permissions of the user.

  10. The Kubernetes API server returns the response to kubectl.

Note

Steps 1 and 2 take place on the Kubernetes API server startup and are not part of the kubectl request authentication. During these steps, the Kubernetes API server obtains the Keycloak public key that it later uses to verify JWTs.

The authentication flow for Helm and other Kubernetes-oriented CLI utilities is identical to the Kubernetes CLI flow, but JWTs must be pre-provisioned.