For an application deployed in Kubernetes would there be any suggested guidance documentation for SAML integration? My search foo is deserting me.
Most documentation are for the Kubernetes itself and not the application. The application would not be aware of Kubernetes RBAC etc.
In the official documentation you can find the following section:
Kubernetes uses client certificates, bearer tokens, or an authenticating proxy to authenticate API requests through authentication plugins. As HTTP requests are made to the API server, plugins attempt to associate the following attributes with the request:
- Username: a string which identifies the end user. Common values might be
kube-adminorjane@example.com.- UID: a string which identifies the end user and attempts to be more consistent and unique than username.
- Groups: a set of strings, each of which indicates the user's membership in a named logical collection of users. Common values might be
system:mastersordevops-team.- Extra fields: a map of strings to list of strings which holds additional information authorizers may find useful.
All values are opaque to the authentication system and only hold significance when interpreted by an authorizer.
You can enable multiple authentication methods at once. You should usually use at least two methods:
- service account tokens for service accounts
- at least one other method for user authentication.
When multiple authenticator modules are enabled, the first module to successfully authenticate the request short-circuits evaluation. The API server does not guarantee the order authenticators run in.
The
system:authenticatedgroup is included in the list of groups for all authenticated users.Integrations with other authentication protocols (LDAP, SAML, Kerberos, alternate x509 schemes, etc) can be accomplished using an authenticating proxy or the authentication webhook.
As you can see to add SAML to your configuration you can use authenticating proxy or the authentication webhook.
If you search an example how to set SAML in Kubernetes, you can read this article.
However, in the vast majority of cases, SAML will extend (rather than replace) the RBAC functionality. See also article How SAML 2.0 Authentication Works?
