CODEWITHSUNDEEP
securityauthenticationkubernetesoauth-2.0
twinley
twinley

Reputation: 63

How to authenticate api calls in Kubernetes

I am planning on building a K8s cluster with many microservices (each running in pods with services ensuring communication). I'm trying to understand how to ensure communication between these microservices is secure. By communication, I mean HTTP calls between microservice A and microservice B's API.

Usually, I would implement an OAuth flow, where an auth server would receive some credentials as input and return a JWT. And then the client could use this JWT in any subsequent call.

I expected K8s to have some built-in authentication server that could generate tokens (like a JWT) but I can't seem to find one. K8s does have authentication for its API server, but that only seems to authenticate calls that perform Kubernetes specific actions such as scaling a pod or getting secrets etc. However, there is no mention of simply authenticating HTTP calls (GET POST etc).

Should I just create my own authentication server and make it accessible via a service or is there a simple and clean way of authenticating API calls automatically in Kubernetes?

Upvotes: 2

Views: 1056

Answers (1)

Harsh Manvar
Harsh Manvar

Reputation: 30160

Not sure how to answer this vast question, however, i will try my best.

There are multiple solutions that you could apply but again there is nothing in K8s for auth you can use.

Either you have to set up the third-party OAuth server or IAM server etc, or you write and create your own microservice.

There are different areas which you cannot merge,

For service interconnection service A to service B it would be best to use the service mesh like Istio and LinkerD which provide the mutual TLS support for security and are easy to set up also.

So the connection between services will be HTTPS and secured but it's on you to manage it and set it up.

If you just run plain traffic inside your backend you can follow the same method that you described.

Passing plain HTTP with jwt payload or so in backend services.

Keycloak is also a good idea to use the OAuth server, i would also recommend checking out Oauth2-proxy

Listing down few article also that might be helpful

https://medium.com/codex/api-authentication-using-istio-ingress-gateway-oauth2-proxy-and-keycloak-a980c996c259

My Own article on Keycloak with Kong API gateway on Kubernetes

https://faun.pub/securing-the-application-with-kong-keycloak-101-e25e0ae9ec56

GitHub files for POC : https://github.com/harsh4870/POC-Securing-the--application-with-Kong-Keycloak

Keycloak deployment on K8s : https://github.com/harsh4870/Keycloack-postgres-kubernetes-deployment

Upvotes: 1

Related Questions