Skip to content

Chapter 7 of 8

Security, Identity, and Admission Control

A ServiceAccount provides an identity for processes running in a Pod, used to authenticate to the API server and to be authorized by RBAC. Every namespace has a default ServiceAccount, and Pods that do not specify one are automatically assigned it. Role-Based Access Control (RBAC) is the standard authorization mode, using Roles and ClusterRoles to define permission sets, and RoleBindings and ClusterRoleBindings to grant those permissions to subjects (users, groups, or ServiceAccounts). A Role grants access within a single namespace, while a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via a RoleBinding.

Pod-level security is configured through the PodSecurityContext, which sets security-relevant fields such as runAsUser, runAsGroup, fsGroup, seccompProfile, runAsNonRoot, and supplemental groups. Historically, PodSecurityPolicy (PSP) enforced similar controls, but PSP was deprecated in Kubernetes 1.21 and removed in 1.25. It has been replaced by Pod Security Admission (PSA), a built-in admission controller that enforces Pod Security Standards at three levels: privileged, baseline, and restricted, configured per namespace via labels.

Admission control can also be extended. A ValidatingAdmissionPolicy uses CEL-based rules to validate incoming API requests declaratively (beta in 1.30), and a MutatingAdmissionWebhook intercepts requests before persistence to mutate objects, used by service meshes, sidecar injectors (such as Istio), and secret backends. The API server's default authentication chain processes X509 client certificates, bearer tokens (including ServiceAccount tokens), OpenID Connect tokens, bootstrap tokens, and anonymous auth (when enabled). A bootstrap token is a short-lived token (24 hours or longer) used to authenticate new nodes joining the cluster, typically during kubeadm join.

All chapters
  1. 1Pods and Container Fundamentals
  2. 2Workload Controllers and Scaling
  3. 3Services, Networking, and Discovery
  4. 4Namespaces, Configuration, and Storage
  5. 5Cluster Architecture and Scheduling
  6. 6Resource Management and Probes
  7. 7Security, Identity, and Admission Control
  8. 8Tooling, Extensibility, and Operations

Drill it

Reading is not remembering. These come from the Kubernetes Core Objects Cheatsheet deck:

Q

What is a Kubernetes Pod?

A Pod is the smallest deployable unit in Kubernetes; it encapsulates one or more tightly coupled containers that share a network namespace, IPC, and optionally...

Q

What does a Pod represent in the Kubernetes object model?

A Pod represents a single instance of a running process in a cluster and is described by a Pod manifest containing metadata (labels, annotations) and a pod spec...

Q

What Kubernetes object directly manages a set of identical Pods?

A ReplicaSet manages a stable set of identical Pods and ensures a specified number of pod replicas are running at any given time.

Q

What controller is most commonly used to deploy stateless workloads in production?

A Deployment, which manages a ReplicaSet and provides declarative updates, rolling updates, and rollback capability.