Kubernetes security fundamentals: Authentication

This post explains how Kubernetes handles authentication across the core API and other components, assessing built-in methods (static/bootstrap tokens, client certificates, service accounts), external options (OIDC, webhooks, authenticating/impersonating proxies), and managed-service nuances (AKS, GKE, EKS). It highlights potential abuse vectors (stolen service account tokens, CSR-issued client certs for persistence, direct kubelet access) and recommends defenses such as avoiding client certs for users, shortening token lifetimes, auditing CSR activity, and properly securing kubelet, controller/scheduler endpoints, kube-proxy exposure, and etcd CA trust.