<p>I am starting to experiment with Oauth2 authorisation for a Kubernetes cluster. </p>

<p>I have found a good Oauth2 identity provider using <a href="https://github.com/hortonworks/docker-cloudbreak-uaa" rel="nofollow noreferrer">UAA</a></p>

<p>My original intention was to deploy this into a Kubernetes cluster, and then allow it to provide authentication over that cluster. This would provide a single sign on solution hosted in the cloud, and enable that solution to manage Kubernetes access as well as access to the applications running on my cluster. </p>

<p>However, when thinking this solution through, there would seem to be some edge cases where this kind of configuration could be catastrophic. For instance if my cluster stops then I do not think I will be able to restart that cluster, as the Oauth2 provider would not be running, and thus I could not be authenticated to perform any restart operations.</p>

<ul>
<li>Has anybody else encountered this conundrum ? </li>
<li>Is this a real risk ? </li>
<li>Is there a 'standard' approach to circumvent this issue ? </li>
</ul>

<p>Many Thanks for taking the time to read this !</p>

<p>Kubernetes support multiple authentication( ref: <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/</a>).</p>

<p>You can enable multiple of them. You can log into kubernetes cluster using any of the them(if they enabled and configured correctly) .</p>

<p>According to kubernetes documentation: <strong>When multiple authenticator modules are enabled, the first module to successfully authenticate the request short-circuits evaluation. The API server does not guarantee the order authenticators run in.</strong></p>

<p>So, if you enable multiple authentication, i think you are fine. I am using kubernetes cluster. In that cluster certificates authentication and <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication" rel="nofollow noreferrer">webhook token authentication</a> using <a href="https://github.com/appscode/guard" rel="nofollow noreferrer">guard</a> is enabled. And this <a href="https://github.com/appscode/guard" rel="nofollow noreferrer">guard</a> is running in that kubernetes cluster.</p>
