<blockquote>
<p>I'm trying to architect a micro-service application, that runs in Kubernetes. It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.</p>
</blockquote>
<p>This is a good idea.</p>
<blockquote>
<p>So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs. I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.</p>
</blockquote>
<p>Just to make it clear: Kubernetes is a container orchestrator, e.g. a way to manage your services. It consists of a <em>control plane</em> (think management of apps) and a <em>data plane</em> (think your apps and customer traffic). Both parts may require proper authentication and authorization. When it comes to your &quot;business idea&quot; - it is about the <em>data plane</em> - here this problem is orthogonal to the platform (e.g. Kubernetes or Heroku) that you run your apps on. So think how you should solve your problem with Microservice architecture, and not so much about Kubernetes.</p>
<blockquote>
<p>In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.</p>
</blockquote>
<p>The most common protocol for this nowadays is to use <a href="https://openid.net/connect/" rel="nofollow noreferrer">OpenID Connect</a> - that is the protocol behind both e.g. Google Accounts and Microsoft Azure AD. What you need is an <em>OpenID Connect provider</em> implementation. The most commonly used open source implementation is <a href="https://www.keycloak.org/" rel="nofollow noreferrer">Keycloak</a>. Remember, this kind of service is <em>stateful</em> and you will need a database as well.</p>
<p>Instead of setting up your own OpenID Connect provider, you could also let the user use an account that he already has, e.g. a Google Account or Twitter Account - it depends on your use case.</p>
<blockquote>
<p>I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.</p>
</blockquote>
<p>What you talk about here is mostly <em>validation of authentication</em> and this is sometimes done using &quot;auth aware ingress controllers&quot;. With OpenID Connect protocol, the user send a <a href="https://www.jsonwebtoken.io/" rel="nofollow noreferrer">JWT</a>-token as proof of authentication, and you could redirect unauthenticated users to your <em>Open ID Connect provider</em>.</p>

CC BY-SA 4.0
2021-03-29T16:32:45.817Z
I haven't actually implemented it yet, but Keycloak comes up frequently and seems indeed to be the way to go. Accepted, and when implemented I will update this Question with my findings.
Erik Oosterwaal
CC BY-SA 4.0
2021-03-10T18:39:26.567Z
2021-03-10T18:39:26.567Z
Jonas
<p>I'm trying to architect a micro-service application, that runs in Kubernetes.
It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.</p>
<p>In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.</p>
<p>So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs.
I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.</p>
<p>I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.</p>
<p>Does anyone have experience in such a setup, that can point me in the right direction?</p>

<kubernetes><ingress><authentication><api-gateway>
How do I implement user authentication and management in Kubernetes?
Erik Oosterwaal
# How do I implement user authentication and management in Kubernetes?

(Asked by: username_0 on 2021-03-07)

I'm trying to architect a micro-service application, that runs in Kubernetes.
It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.

In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.

So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs.
I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.

I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.

Does anyone have experience in such a setup, that can point me in the right direction?

**Tags:** kubernetes, ingress, authentication, api-gateway


---

## 1 answers

### Answer by username_1 on 2021-03-10. Score: 1 | Accepted answer

> I'm trying to architect a micro-service application, that runs in Kubernetes. It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.

This is a good idea.

> So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs. I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.

Just to make it clear: Kubernetes is a container orchestrator, e.g. a way to manage your services. It consists of a *control plane* (think management of apps) and a *data plane* (think your apps and customer traffic). Both parts may require proper authentication and authorization. When it comes to your "business idea" - it is about the *data plane* - here this problem is orthogonal to the platform (e.g. Kubernetes or Heroku) that you run your apps on. So think how you should solve your problem with Microservice architecture, and not so much about Kubernetes.

> In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.

The most common protocol for this nowadays is to use [OpenID Connect](https://openid.net/connect/) - that is the protocol behind both e.g. Google Accounts and Microsoft Azure AD. What you need is an *OpenID Connect provider* implementation. The most commonly used open source implementation is [Keycloak](https://www.keycloak.org/). Remember, this kind of service is *stateful* and you will need a database as well.

Instead of setting up your own OpenID Connect provider, you could also let the user use an account that he already has, e.g. a Google Account or Twitter Account - it depends on your use case.

> I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.

What you talk about here is mostly *validation of authentication* and this is sometimes done using "auth aware ingress controllers". With OpenID Connect protocol, the user send a [JWT](https://www.jsonwebtoken.io/)-token as proof of authentication, and you could redirect unauthenticated users to your *Open ID Connect provider*.

> **Comments:**
> **username_0**: I haven't actually implemented it yet, but Keycloak comes up frequently and seems indeed to be the way to go. Accepted, and when implemented I will update this Question with my findings.  

---

