<p>Currently, I am developing some back-end API, let's call them A, B and C. I'm willing to use Kubernetes for orchestration.</p>
<p>I need to have Authentication and authorization for only A and B APIs.</p>
<p>How could I implement authentication and authorization for only some api?</p>

<p>Kubernetes is an orchestration service it doesn't provide the feature of Auth Z/Auth N.</p>
<p>You have options like creating the <strong>Auth</strong> <strong>service</strong> in the backend or using the service Mesh or API gateway to implement the AuthZ/Auth N at the edge.</p>
<p>If you are looking for more functionality i would recommend implementing the <strong>Kong API gateway</strong> with K8s and Keycloak as an identity provider.</p>
<p>With you can implement the <strong>AuthZ/AuthN</strong>, rate limiting, API key auth, Basic auth, JWT etc.</p>
<p>You can read my article for implementation : <a href="https://faun.pub/securing-the-application-with-kong-keycloak-101-e25e0ae9ec56" rel="nofollow noreferrer">https://faun.pub/securing-the-application-with-kong-keycloak-101-e25e0ae9ec56</a></p>
<p>Article implementing Oauth and OIDC however with Kong and Keycloak you can change the Auth option as per need, it's flexible.</p>
<p>So at the kong level, you can create the API and route and upon that you can set the security policy as you have use case. Kong also supports the UI dashboard (Konga) so it would be easy to manage also.</p>
