Skip to content

Commit

Permalink
Update content/Projects/Observability/kube-rbac-proxy.md
Browse files Browse the repository at this point in the history
Co-authored-by: Simon Pasquier <[email protected]>
  • Loading branch information
rexagod and simonpasquier authored Feb 20, 2024
1 parent d8b547c commit de49bba
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion content/Projects/Observability/kube-rbac-proxy.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,9 @@ kube-rbac-proxy can be configured with one of the 2 mechanisms for authenticatio
** [delegated authentication](https://github.com/kubernetes/apiserver/blob/8ad2e288d62d02276033ea11ee1efd94bb627836/pkg/authentication/authenticatorfactory/delegating.go#L102-L112) relies on Bearer tokens. The token represents the identity of the user or service account that is making the request and kube-rbac-proxy uses a [`TokenReview` request](https://github.com/kubernetes/apiserver/blob/21bbcb57c672531fe8c431e1035405f9a4b061de/plugin/pkg/authenticator/token/webhook/webhook.go#L51-L53) to verify the identity of the client.
** If kube-rbac-proxy is configured with a client certificate authority, it can also verify the identify of the client presenting a TLS certificate. Some monitoring components use this [mechanism](#downstream-usage) which avoids a round-trip communication with the Kubernetes API server.

Note that anonymous access is always disabled, and the proxy doesn't rely on HTTP headers to authenticate the request but it can add them if started with `--auth-header-fields-enabled`. Refer [this page](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) for more information on authentication in Kubernetes.
Note that anonymous access is always disabled, and the proxy doesn't rely on HTTP headers to authenticate the request but it can add them if started with `--auth-header-fields-enabled`.

Refer [this page](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) for more information on authentication in Kubernetes.

### [**Authorization**](https://github.com/brancz/kube-rbac-proxy/blob/1c7f88b5e951d25a493a175e93515068f5c77f3b/pkg/authz/auth.go#L31C1-L37)

Expand Down

0 comments on commit de49bba

Please sign in to comment.