# 【kube-apiserver】Authentication：SA、Bearer、OIDC 边界

DevFeed: [【kube-apiserver】Authentication：SA、Bearer、OIDC 边界](<https://devfeed.tech/articles/kube-apiserver-authentication-sa-bearer-oidc-33966.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/10-authentication/10-authentication.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [authz](<https://devfeed.tech/topics/authz.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [bearer-token](<https://devfeed.tech/tags/bearer-token.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [serviceaccount](<https://devfeed.tech/tags/serviceaccount.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>)

## AI overview

This Chinese-language tutorial explains the kube-apiserver authentication chain in Kubernetes v1.30.3. It distinguishes X.509 certificates, ServiceAccount tokens, static and bootstrap tokens, OIDC JWTs, webhook authentication, and anonymous requests, and separates authentication failures such as 401 from storage-layer failures such as 503 or 504.

## Source excerpt

钉 K8s v1.30.3 的认证链：X509、SA token（bound token）、Bearer、OIDC、Webhook token、匿名用户；ServiceAccount bound token 与 TokenRequest 语义；apiserver 认证 flags 边界；401 与存储层故障的分列；AuthZ 路径见第 11 篇。