Authentication and authorization architecture

Details on distributed authentication and authorization between clusters

Authentication

Kommander comes with a pre-configured authentication Dex identity broker and provider.

IMPORTANT: Kubernetes, Kommander, and Dex do not store any user identities. The Kommander installation comes with default admin static credentials. These credentials should only be used to access the Kommander dashboard for configuring an external identity provider. There is currently no way to update these credentials so they should be treated as backup credentials and not used for normal access.

The Kommander dashboard admin credentials are stored as a secret. They never leave the boundary of the Kommander cluster and are never shared to any other cluster.

The Dex service issues an OIDC ID token on successful user authentication. Other platform services use the ID token as an authentication proof. User identity to the Kubernetes API server is provided by the kube-oidc-proxy platform service that reads the identity from an ID token. Web requests to Kommander dashboard access are authenticated by the traefik forward auth platform service.

NOTE: The kube-oidc-proxy service authenticates kubectl CLI requests using the Kubernetes API Server Go library. This library requires that if an email_verified claim is present, it must be set to true, even if the insecureSkipEmailVerified: true flag is configured in the Dex connector. Thus, ensure that the OIDC provider is configured to set the email_verified field to 'true'

A user identity is shared across a Kommander cluster and all other attached clusters.

Kommander attached clusters

A newly attached cluster has federated kube-oidc-proxy, dex-k8s-authenticator, and traefik-forward-auth platform services. These platform services are configured to accept Kommander cluster Dex issued ID tokens.

When the traefik-forward-auth is used as a Traefik Ingress authenticator, it checks if the user identity was issued by the Kommander cluster Dex service. An anonymous user is redirected to the Kommander cluster Dex service to authenticate and confirm their identity.

Never enter your own credentials on any of the attached clusters. On the Kommander cluster use the static admin credentials or an external identity provider (IDP).

Authorization

There is no centralized authorization component in Kommander. Each component and service makes its own authorization decisions based on user identity.