kubernetes-in-depth analysis of cluster security mechanisms (3.6)

The security of the cluster mainly considers the following aspects:

1. Isolation of the container from the host;
2. Limiting the ability of containers to adversely affect infrastructure and other containers;
3. The principle of least privilege--to reasonably restrict the permissions of all components, to ensure that the component only performs its mandated behavior, limiting the scope of the permissions it can achieve by restricting the ability of a single component;
4. Defining the division of component boundaries;
5. Dividing the roles of ordinary users and administrators;
6. Allow administrator privileges to be assigned to ordinary users when necessary;
7. Allows applications that have "Secret" data (keys,cert,passwords) to run in the cluster.

The Kubernetes cluster provides three levels of client identity authentication:

1. The strictest HTTPS certificate authentication: Two-way Digital certificate authentication method based on CA root certificate signature;
2. HTTPS token authentication: Identify legitimate users through a token;
3. HTTP Base authentication: Authentication by user name + password;

kubernetes-in-depth analysis of cluster security mechanisms (3.6)