<p>I am using Kubernetes on a coreOS cluster hosted on DigitalOcean.
And using <a href="https://github.com/cescoferraro/kubernetes-do" rel="nofollow noreferrer">this</a> repo to set it up. I started the apiserver with the following line:</p>
<pre><code>    /opt/bin/kube-apiserver --runtime-config=api/v1 --allow-privileged=true \ 
     --insecure-bind-address=0.0.0.0 --insecure-port=8080 \
     --secure-port=6443 --etcd-servers=http://127.0.0.1:2379 \
     --logtostderr=true --advertise-address=${COREOS_PRIVATE_IPV4} \
     --service-cluster-ip-range=10.100.0.0/16 --bind-address=0.0.0.0
</code></pre>
<p>The problem is that it accepts requests from anyone! I want to be able to provide a simple user/password authentication. I have been reading <a href="https://github.com/kubernetes/kubernetes/blob/master/docs/admin/authentication.md" rel="nofollow noreferrer">this</a> and <a href="https://github.com/kubernetes/kubernetes/blob/master/docs/design/security.md" rel="nofollow noreferrer">this</a> and it seems that I have to do something like the below, but I cannot afford to take the cluster down for a long period of time, so I need your guys to help with this one. Btw, my pods do not create another pods, so I only need a few user, like 1/2 for devs and 1 for CI.</p>
<p>I am thinking of doing something like including authorization-mode and authorization-policy-file flags as it seems required and making the insecure-bind-address localhost to make it only available locally. I am missing something?</p>
<pre><code>    /opt/bin/kube-apiserver --runtime-config=api/v1 --allow-privileged=true \ 
     --authorization-mode=ABAC --authorization-policy-file=/access.json \
     --insecure-bind-address=127.0.0.1 --insecure-port=8080 \
     --secure-port=6443 --etcd-servers=http://127.0.0.1:2379 \
     --logtostderr=true --advertise-address=${COREOS_PRIVATE_IPV4} \
     --service-cluster-ip-range=10.100.0.0/16 --bind-address=0.0.0.0
</code></pre>
<p>###/access.json</p>
<pre><code>{&quot;user&quot;:&quot;admin&quot;}
{&quot;user&quot;:&quot;wercker&quot;}
{&quot;user&quot;:&quot;dev1&quot;}
{&quot;user&quot;:&quot;dev2&quot;}
</code></pre>
<p>But where are the passwords? How do I actually make the request with kubectl and curl or httpie?</p>

CESCO
<p>If you want your users to authenticate using HTTP Basic Auth (user:password), you can add:</p>

<pre><code>--basic-auth-file=/basic_auth.csv
</code></pre>

<p>to your kube-apiserver command line, where each line of the file should be <code>password, user-name, user-id</code>. E.g.:</p>

<pre><code>@dm1nP@ss,admin,admin
w3rck3rP@ss,wercker,wercker
etc...
</code></pre>

<p>If you'd rather use access tokens (HTTP Authentication: Bearer), you can specify:</p>

<pre><code>--token-auth-file=/known-tokens.csv
</code></pre>

<p>where each line should be <code>token,user-name,user-id[,optional groups]</code>. E.g.:</p>

<pre><code>@dm1nT0k3n,admin,admin,adminGroup,devGroup
w3rck3rT0k3n,wercker,wercker,devGroup
etc...
</code></pre>

<p>For more info, checkout the <a href="http://kubernetes.io/docs/admin/authentication/" rel="noreferrer">Authentication docs</a>. Also checkout <a href="https://github.com/kubernetes/kubernetes/blob/master/pkg/auth/authorizer/abac/example_policy_file.jsonl" rel="noreferrer">example_policy_file.jsonl</a> for an example ABAC file.</p>
