在 k8s 中服务请求的身份验证

Question

Say I have several services in kubernetes. And I have one entry point to the cluster, it's a public facing service that is meant to validate the JWT token (from AWS cognito).

The entry point routes the request to an internal service, and that in turn usually makes more requests to other internal services.

My question is: is it enough to validate the JWT only once and make other communications without any form of authentication, just passing the user id (or any other data needed)? Or do I need to have some form of authentication when making http requests between services? if so, which? should i validate the JWT again? should I have server certificates or something like that?

Answer 1

Posted a community wiki answer for better visibility. Feel free to expand it.

---

As David Szalai's comment mentioned, it depends on your security and project requirements:

If you go with a zero-trust model inside k8s, you can use mTLS with a service mesh between services. Passing JWTs is also good if you need to propagate user-auth info to different services.

In the current (project) we'll use mTLS with a service mesh, and send JWTs along with requests where the receiver needs info about user, and parse/validate it there again.

If you apps do not have built-in authentication / authorization mechanisms you may try Istio - check these articles:

• Istio documentation - Security
• Istio & JWT: Step by Step Guide for Micro-Services Authentication .

Also check these articles about authentication in Kubernetes:

• Kubernetes Docs - Authenticating
• Authentication between microservices using Kubernetes identities