Kubernetes security fundamentals: Authorization

This post explains how Kubernetes authorization works, detailing built-in authorization modules (AlwaysAllow/AlwaysDeny, Node Authorizer, ABAC, RBAC, and webhook authorization), nuances like namespace vs. cluster-scoped roles and virtual verbs, and non-resource endpoints. It highlights risks such as the power of the `system:masters` group and kubelet `proxy` access, outlines how kubelet, scheduler, and controller-manager authorization is enforced (primarily via RBAC and SubjectAccessReview), and underscores the complexity of auditing permissions across multiple authorizers in a cluster.