Privileged Access to Clusters

In addition to managing authentication, most enterprises require a concept of “privileged access management”, where not only is access limited by user but by time as well. Most enterprises require a change control process of some kind to ensure that changes to production systems are tracked and approved. This requirement generally comes from any of the various compliance and regulatory frameworks needed in large enterprises.

There are generally three ways to manage privileged access in Kubernetes, and we’ll cover all three with their benefits and drawbacks.

Using a Privileged User Account

It is common for enterprises to require that administrators have two accounts, one for day-to-day tasks and one for making administrative changes. This approach is generally implemented using a Privilege Access Manager (PAM) that generates a new password for the user when they’re authorized to do their work. This approach enables compliance with...