Understanding key Kubernetes concepts

Kubernetes clusters have two categories of users: service accounts managed by Kubernetes, and normal users (administrators, developers, etc.). Kubernetes (K8s) is extensible by design and supports multiple authentication plugins. We will focus on the most common one, client certificates, while discussing generic user authentication/authorization in Kubernetes.

Using the client certificates’ plugin, users are considered authenticated when they furnish a valid certificate signed by the cluster’s certificate authority (CA).

With a valid certificate, Kubernetes determines the username from the common name field in the Subject of the certificate (e.g., /CN=bob) while the group information is provided in the Organization field (e.g., /O=dev). From this point onwards, the role-based access control (RBAC) sub-system will determine whether the user is authorized to perform a particular operation on a resource.

The following diagram...