<p>I am starting to experiment with Oauth2 authorisation for a Kubernetes cluster. </p>

<p>I have found a good Oauth2 identity provider using <a href="https://github.com/hortonworks/docker-cloudbreak-uaa" rel="nofollow noreferrer">UAA</a></p>

<p>My original intention was to deploy this into a Kubernetes cluster, and then allow it to provide authentication over that cluster. This would provide a single sign on solution hosted in the cloud, and enable that solution to manage Kubernetes access as well as access to the applications running on my cluster. </p>

<p>However, when thinking this solution through, there would seem to be some edge cases where this kind of configuration could be catastrophic. For instance if my cluster stops then I do not think I will be able to restart that cluster, as the Oauth2 provider would not be running, and thus I could not be authenticated to perform any restart operations.</p>

<ul>
<li>Has anybody else encountered this conundrum ? </li>
<li>Is this a real risk ? </li>
<li>Is there a 'standard' approach to circumvent this issue ? </li>
</ul>

<p>Many Thanks for taking the time to read this !</p>

<p>The use of UAA consists of two 2 procedures—authentification and authorization—where the latter allows for performing certain actions within a cluster. They are used through the kubectl command-line tool. </p>

<p>One can use <strong>2 existing modules of authorization</strong> (<a href="https://kubernetes.io/docs/reference/access-authn-authz/abac/" rel="nofollow noreferrer">ABAC</a> and <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a>). <a href="https://www.altoros.com/blog/configuring-uaa-to-provide-a-single-entry-point-for-kubernetes-and-cloud-foundry/" rel="nofollow noreferrer">Here</a> you can find a side-by-side comparison of these two options where the author vouched for the RBAC mode as it "doesn’t require the API server to be restarted every time the policy files get updated". </p>

<p>If I understood your question right, <a href="https://www.altoros.com/blog/configuring-uaa-to-provide-a-single-entry-point-for-kubernetes-and-cloud-foundry/" rel="nofollow noreferrer">this article</a> may be of help. </p>
