Q13: Kube-API Server Request Lifecycle: Authentication, Authorization, Mutating and Validating Admission Controllers. - DevOps & Kubernetes (50 Qs)

Deep Dive: Inside the Kube-API Server

Every incoming request to the API server (from kubectl, Kubelet, or internal controllers) must pass through a strict 3-phase pipeline before the object is committed to etcd.

sql

[ Incoming HTTP Request ]
           |
           v
+------------------------+
| 1. Authentication      | -> X.509 Client Certs, OIDC Bearer Tokens, Webhook Tokens
+------------------------+
           | (Authenticated User & Groups)
           v
+------------------------+
| 2. Authorization       | -> RBAC (Role/ClusterRole), Node Auth, ABAC, Webhook
+------------------------+
           | (Authorized to perform action)
           v
+----------------------------------------------------+
| 3. Admission Control                               |
|                                                    |
|   +--------------------------------------------+   |
|   | 3a. Mutating Admission Webhooks            |   | -> Modifies object (injects sidecars, default limits)
|   +--------------------------------------------+   |
|                         |                          |
|   +--------------------------------------------+   |
|   | 3b. Object Schema Validation               |   | -> Validates OpenAPI specs and syntax
|   +--------------------------------------------+   |
|                         |                          |
|   +--------------------------------------------+   |
|   | 3c. Validating Admission Webhooks          |   | -> Accepts or Rejects (OPA Gatekeeper, Kyverno)
|   +--------------------------------------------+   |
+----------------------------------------------------+
           |
           v
   [ Write to etcd ]

Phase Breakdown

Authentication (AuthN): Verifies caller identity. Examples:
- Human operators: OIDC tokens (Okta, Azure AD, GitHub).
- Control plane nodes: X.509 client certificates.
- Pods: Projected ServiceAccount JWT tokens.
Authorization (AuthZ): Evaluates permissions (User, Verb, Namespace, Resource). Standard is RBAC (Role-Based Access Control). Evaluated sequentially; first allow grants access.
Admission Control:
- Mutating Webhook: Can alter the incoming payload (e.g., Istio automatically injecting the istio-proxy sidecar container, or Kyverno defaulting securityContext fields).
- Validating Webhook: Can only accept or reject (HTTP 200 or 403). Examples: blocking images with :latest tag, blocking root containers, enforcing namespace resource quotas.