<p>I am planning on building a K8s cluster with many microservices (each running in pods with services ensuring communication). I'm trying to understand how to ensure communication between these microservices is secure. By communication, I mean HTTP calls between microservice A and microservice B's API.</p>
<p>Usually, I would implement an OAuth flow, where an auth server would receive some credentials as input and return a JWT. And then the client could use this JWT in any subsequent call.</p>
<p>I expected K8s to have some built-in authentication server that could generate tokens (like a JWT) but I can't seem to find one.
K8s does have authentication for its API server, but that only seems to authenticate calls that perform Kubernetes specific actions such as scaling a pod or getting secrets etc.
However, there is no mention of simply authenticating HTTP calls (GET POST etc).</p>
<p>Should I just create my own authentication server and make it accessible via a service or is there a simple and clean way of authenticating API calls automatically in Kubernetes?</p>

<p>Not sure how to answer this vast question, however, i will try my best.</p>
<p>There are multiple solutions that you could apply but again there is nothing in K8s for auth you can use.</p>
<p>Either you have to set up the third-party OAuth server or IAM server etc, or you write and create your own microservice.</p>
<p>There are different areas which you cannot merge,</p>
<p>For service interconnection <strong>service A</strong> to <strong>service B</strong> it would be best to use the service mesh like <strong>Istio</strong> and <strong>LinkerD</strong> which provide the <strong>mutual TLS</strong> support for security and are easy to set up also.</p>
<p>So the connection between services will be <strong>HTTPS</strong> and secured but it's on you to manage it and set it up.</p>
<p>If you just run plain traffic inside your backend you can follow the same method that you described.</p>
<p>Passing plain <strong>HTTP</strong> with jwt payload or so in backend services.</p>
<p><a href="https://www.keycloak.org/" rel="nofollow noreferrer">Keycloak</a> is also a good idea to use the OAuth server, i would also recommend checking out <a href="https://github.com/oauth2-proxy/oauth2-proxy" rel="nofollow noreferrer">Oauth2-proxy</a></p>
<p>Listing down few article also that might be helpful</p>
<p><a href="https://medium.com/codex/api-authentication-using-istio-ingress-gateway-oauth2-proxy-and-keycloak-a980c996c259" rel="nofollow noreferrer">https://medium.com/codex/api-authentication-using-istio-ingress-gateway-oauth2-proxy-and-keycloak-a980c996c259</a></p>
<p>My Own article on Keycloak with Kong API gateway on Kubernetes</p>
<p><a href="https://faun.pub/securing-the-application-with-kong-keycloak-101-e25e0ae9ec56" rel="nofollow noreferrer">https://faun.pub/securing-the-application-with-kong-keycloak-101-e25e0ae9ec56</a></p>
<p>GitHub files for POC : <a href="https://github.com/harsh4870/POC-Securing-the--application-with-Kong-Keycloak" rel="nofollow noreferrer">https://github.com/harsh4870/POC-Securing-the--application-with-Kong-Keycloak</a></p>
<p>Keycloak deployment on K8s : <a href="https://github.com/harsh4870/Keycloack-postgres-kubernetes-deployment" rel="nofollow noreferrer">https://github.com/harsh4870/Keycloack-postgres-kubernetes-deployment</a></p>
