<p>Why is kubectl not asking for a password?</p>

<ul>
<li>I have created a kubernetes cluster on my server with kubeadm</li>
<li>than I installed kubectl on my local machine</li>
<li>and copied the content of /etc/kubernetes/admin.conf from my server into the file ~/.kube/config on my local machine.</li>
</ul>

<p>Now I cann access my own cluster from my local machine with kubectl without the need of a passphrase? Why is this so?</p>

<p>When I want ot access my server via ssh I need of course a user/password or an allowed ssh key. Why does kubectl not ask me for a passphrase?
To me it seems not to be secure enoght. </p>

<p>Kubernetes supports different authentication strategies, defined <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">here</a>.</p>

<p>Generally, Kubernetes cluster uses <code>client certificate authentication</code>. If you look at your <code>~/.kube/config</code> file you'll see a field something like this:</p>

<pre><code>- name: kubernetes-admin
  user:
    client-certificate-data: &lt;BASE64 ENCODED X509 CERTIFICATE&gt;
    client-key-data:  &lt;BASE64 ENCODED PRIVATE KEY FOR THE CERTIFICATE&gt;
</code></pre>

<p>You can see that the <code>kubernetes-admin</code> user has a client certificate data and key. This certificate is trusted by the <code>Certificate Authority (CA)</code> of your cluster. </p>

<p>When you use <code>kubectl</code>, it sends the <code>client certificate data</code> of the user to your cluster and your cluster <code>CA</code> verifies it. If the client is verified, then you can access the cluster.</p>
