0

I'm trying to architect a micro-service application, that runs in Kubernetes. It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.

In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.

So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs. I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.

I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.

Does anyone have experience in such a setup, that can point me in the right direction?

1

I'm trying to architect a micro-service application, that runs in Kubernetes. It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.

This is a good idea.

So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs. I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.

Just to make it clear: Kubernetes is a container orchestrator, e.g. a way to manage your services. It consists of a control plane (think management of apps) and a data plane (think your apps and customer traffic). Both parts may require proper authentication and authorization. When it comes to your "business idea" - it is about the data plane - here this problem is orthogonal to the platform (e.g. Kubernetes or Heroku) that you run your apps on. So think how you should solve your problem with Microservice architecture, and not so much about Kubernetes.

In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.

The most common protocol for this nowadays is to use OpenID Connect - that is the protocol behind both e.g. Google Accounts and Microsoft Azure AD. What you need is an OpenID Connect provider implementation. The most commonly used open source implementation is Keycloak. Remember, this kind of service is stateful and you will need a database as well.

Instead of setting up your own OpenID Connect provider, you could also let the user use an account that he already has, e.g. a Google Account or Twitter Account - it depends on your use case.

I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.

What you talk about here is mostly validation of authentication and this is sometimes done using "auth aware ingress controllers". With OpenID Connect protocol, the user send a JWT-token as proof of authentication, and you could redirect unauthenticated users to your Open ID Connect provider.

1
  • I haven't actually implemented it yet, but Keycloak comes up frequently and seems indeed to be the way to go. Accepted, and when implemented I will update this Question with my findings. – Erik Oosterwaal Mar 29 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.