Feature Overview
TKE Authenticator is an identity authentication and authorization component provided by Tencent Kubernetes Engine (TKE). It provides identity authentication and access control capabilities based on Tencent Cloud CAM for TKE clusters. It allows users to access Kubernetes clusters through Tencent Cloud CAM identities without storing any static cluster credentials locally. It also supports integrating the Kubernetes RBAC permission management mechanism with Tencent Cloud CAM user groups, facilitating fine-grained access control for sub-accounts.
CAM Authentication
The CAM identity authentication feature is implemented through the Authentication Webhook, which maps Tencent Cloud CAM identities to Kubernetes RBAC users and user groups. When used with the client tool tke-cam-tool, it builds a bridge from CAM identities to Kubernetes RBAC users/groups, thereby avoiding the need to store any static cluster credentials locally, such as x509 client certificates or static tokens. Users can generate kubeconfig files and tokens through tke-cam-tool, define the mapping from CAM identities to Kubernetes users by deploying CAMIdentityMapping CRD resources, and then implement cluster access control based on CAM identities in combination with standard Kubernetes RBAC permission rules.
CAM User Group Authentication
The CAM user group authentication feature is implemented through the Authorization Webhook, which supports integrating the Kubernetes RBAC permission management mechanism with Tencent Cloud CAM user groups. This feature is enabled by default after the component is installed. A CAM user group is a collection of users (sub-accounts) with the same responsibilities. By adding sub-accounts to the corresponding CAM user group and binding Kubernetes RBAC rules to the user group (with kind set to Group and name set to the CAM user group ID in subjects), you can manage cluster permissions in batches by team, without configuring RBAC rules for each user individually.
References