The title of the question is "Group authentication in kubernetes" and the original poster asked in the comments "Do you have any link on how to create k8s user group and add user to group". So it could be helpful to answer:
How do you add kubernetes users into groups?
Kubernetes doesn't store usernames and groups in its local database, in a way that's analogous to most other systems. Instead, it depends on being provided the 'username' or 'group' by whatever your preferred authentication mechanism is. Depending upon which method you are using, the way to specify the group differs.
That means you first must determine your authentication method. For example, "I'm using X509 Client Certs" or "I'm using a service account token". That answer can't be "Probably I am just using the default built-in kubernetes users and groups" because unfortunately that's something which doesn't exist.
Based on the authentication method, here are alternative ways to set the 'group'.
(Most of this is taken verbatim from https://kubernetes.io/docs/reference/access-authn-authz/authentication/ with some editing and rearranging for clarity).
X509 Client Certs:
Place the group names in the certification signing request:
openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj "/CN=jbeda/O=app1/O=app2"
This would create a CSR for the username "jbeda", belonging to two groups, "app1" and "app2".
Static Token File:
The API server reads bearer tokens from a file when given the --token-auth-file=SOMEFILE option on the command line. The token file is a csv file with a minimum of 3 columns: token, user name, user uid, followed by optional group names.
If you have more than one group the column must be double quoted e.g.
The authenticator authenticates as system:bootstrap:Token ID. It is included in the system:bootstrappers group. The naming and groups are intentionally limited.
OpenID Connect Tokens:
When configuring the API Server to support OpenID Connect Tokens, add this flag
--oidc-groups-claim JWT claim to use as the user's group. If the claim is present it must be an array of strings. Example: groups Required: No
The identity provider would include 'groups' in the token.
Webhook Token Authentication:
The API server is configured to communication with a remote authentication service. That external service should return a validation in json format that may include an optional group membership:
# Optional group memberships
"groups": ["developers", "qa"],
Configure the API server with this flag:
--requestheader-group-headers 1.6+. Optional, case-insensitive. "X-Remote-Group" is suggested. Header names to check, in order, for the user's groups. All values in all specified headers are used as group names.
Send an http request with X-Remote-Group included in the headers.
GET / HTTP/1.1
When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.
A user can act as another user through impersonation headers.
The following HTTP headers can be used to performing an impersonation request:
Impersonate-User: The username to act as.
Impersonate-Group: A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User".
client-go credential plugins:
Interacts with an external service (LDAP, Kerberos, OAuth2, SAML, etc.).
During the authentication process, the "external service verifies the signature on the token and returns the user's username and groups."
source information from https://kubernetes.io/docs/reference/access-authn-authz/authentication/