# authz Published articles for authz. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界 DevFeed: [【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes]() Tags: [admission](), [api](), [apiserver](), [authz](), [controllers](), [distributed](), [kubernetes](), [mutating](), [namespace-lifecycle](), [openapi](), [resourcequota](), [timeout](), [v1-30-3](), [validating](), [webhook]() ### AI overview This tutorial explains the Kubernetes v1.30.3 admission chain in kube-apiserver. It places Admission between authorization and storage, describes the Mutating-then-Validating order, and covers built-in plugins, webhooks, timeout behavior, and fail-open versus fail-closed considerations. ### Source excerpt 钉 Kubernetes v1.30.3 Admission 链的阶段位置、Mutating 与 Validating 两阶段顺序、内置插件注册路径与典型示例、webhook 边界与 timeout 语义，以及 fail-open vs fail-closed 的工程争议。 ## 【kube-apiserver】进程与请求路径：generic apiserver、HandlerChain 与 REST 路由 DevFeed: [【kube-apiserver】进程与请求路径：generic apiserver、HandlerChain 与 REST 路由]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [API]() Tags: [admission](), [apf](), [apiserver](), [audit](), [authn](), [authz](), [distributed](), [generic-apiserver](), [gvr](), [handlerchain](), [kubernetes](), [request-path](), [rest](), [v1-30-3]() ### AI overview This tutorial explains the Kubernetes v1.30.3 kube-apiserver process model, the generic apiserver framework, HandlerChain ordering, GVR routing, and the points where requests can be rejected before reaching storage. It also distinguishes failures caused by APF, authentication and authorization, admission, and storage. ### Source excerpt 拆解 kube-apiserver 进程模型与 generic apiserver 框架；钉 HandlerChain 各插槽顺序与失败落点；说明 GVR 路由机制与请求在到达 storage 前可能被拦截的位置。版本锚定 Kubernetes v1.30.3。 ## 【kube-apiserver】排障五轴：Storage、Watch、Admission、Auth、APF DevFeed: [【kube-apiserver】排障五轴：Storage、Watch、Admission、Auth、APF]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [API](), [etcd]() Tags: [admission](), [apf](), [apiserver](), [auth](), [authz](), [distributed](), [etcd](), [five-axes](), [kubernetes](), [metrics](), [storage](), [troubleshooting](), [v1-30-3](), [watch]() ### AI overview A troubleshooting guide for kube-apiserver organized around five diagnostic axes: Storage, Watch, Admission, Auth, and API Priority and Fairness. It maps symptoms such as 504, 410 Gone, 401, 403, webhook timeouts, list storms, and OOM to likely axes, explains when to investigate etcd, and emphasizes that commands and metrics were not executed in the author's environment. ### Source excerpt 按 Storage/Watch/Admission/Auth/APF 五轴做症状否证；给出完整五轴命令表与症状->轴映射（504、410、401、403、webhook 超时、List 风暴、OOM）；说明 apiserver_request_duration_seconds 等核心 metrics 语义；并提供决策树：何时穿透到 etcd/15，何时留在 apiserver 轴。 ## 【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列 DevFeed: [【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authorization](), [Kubernetes](), [audit](), [API]() Tags: [403](), [admission](), [api](), [apiserver](), [audit](), [auth](), [authorization](), [authz](), [distributed](), [etcd](), [http](), [k8s](), [kubernetes](), [policy](), [post](), [rbac](), [subjectaccessreview](), [v1](), [v1-30-3](), [webhook]() ### AI overview This tutorial explains Kubernetes v1.30.3 authorization and auditing. It distinguishes the RBAC, Node, Webhook, and legacy ABAC authorizer paths; describes SAR and SSAR access checks; outlines audit policies and stages; and explains why user-facing 403 errors come from Kubernetes authorization rather than etcd permissions or Admission failures. ### Source excerpt 钉 K8s v1.30.3 的授权链：RBAC、Node、Webhook、ABAC（遗留）；SubjectAccessReview / SelfSubjectAccessReview 用法；Audit policy 四级；403 与 etcd 权限错误、Admission 拒绝的分列；不把 etcd 的 mTLS 错误写成 K8s RBAC 故障。 ## Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems DevFeed: [Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems]() Original publisher: [Read original article]() Author: Eaton Published: 2024-03-05T05:00:00Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Single sign-on (SSO)](), [authz](), [vulnerability](), [Angular](), [API keys](), [API]() Tags: [angular](), [api](), [authentication](), [authz](), [security](), [sso](), [vulnerability]() ### AI overview The article describes an ASPEN team's research into an SSO login-flow flaw in an Angular application at a Fortune 500 healthcare company. It explains that exposed client-side API credentials and a user-search API accepting the value "all" enabled retrieval of user information; the reported vulnerability was resolved and mitigated. ### Source excerpt (ASPEN) A critical SSO vulnerability in a Fortune 500 app risked millions of records. Learn about SSO security risks, fixes, and protecting APIs from similar attacks. ## Identity Governance & Security, Community Survey, AWS re:Invent and more. DevFeed: [Identity Governance & Security, Community Survey, AWS re:Invent and more.]() Original publisher: [Read original article]() Author: info@goteleport.com (Ben Arent) Published: 2023-11-16T00:00:00Z Content type: news Language: en Sources: [Teleport]() Topics: [Security](), [audit](), [authz](), [account](), [Kubernetes](), [Amazon Web Services]() Tags: [account](), [audit](), [authz](), [aws](), [devsecops](), [events](), [kubernetes](), [security](), [survey]() ### AI overview Teleport's newsletter highlights its Identity Governance & Security launch, including account and infrastructure access monitoring, audit logs, access reviews, and just-in-time access requests. It also announces a Teleport community survey, AWS re:Invent activities, and a Kubernetes security panel. ### Source excerpt An online version of Teleports monthly newsletter. Covering the latest news, events, and updates from the Teleport team. ## AuthN vs AuthZ: What is Auth? DevFeed: [AuthN vs AuthZ: What is Auth?]() Original publisher: [Read original article]() Author: Keith Richards Published: 2023-03-22T17:48:14Z Content type: tutorial Language: en Sources: [Clever]() Topics: [Authentication](), [Authorization](), [passwords](), [Algorithm]() Tags: [algorithm](), [auth](), [authentication](), [authn](), [authorization](), [authz](), [password]() ### AI overview This tutorial explains the distinction between authentication, which verifies identity, and authorization, which determines access to resources. It also describes username-and-password authentication, password hashing, and certificate exchange for device identity verification. ### Source excerpt Demystifying authentication and authorization When you hear the term Auth, what comes to mind? You probably think of signing into a system with your username and password, and you're half right. But auth is bigger than that. The bucket term also includes everything you can do in a system once you submit those credentials. Auth [...] The post AuthN vs AuthZ: What is Auth? appeared first on Clever Engineering Blog. ## Tutorial: Authentication and Authorization for Kubernetes DevFeed: [Tutorial: Authentication and Authorization for Kubernetes]() Original publisher: [Read original article]() Author: info@goteleport.com (Lukonde Mwila) Published: 2022-02-15T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Tutorial](), [Authentication](), [Authorization]() Tags: [access-control](), [api](), [api-server](), [authentication](), [authn](), [authorization](), [authz](), [cli](), [crud](), [devops](), [kubernetes](), [permissions](), [scheduler](), [security](), [tutorial]() ### AI overview This tutorial explains the difference between authentication and authorization in Kubernetes. It describes how the Kubernetes API server validates the identity of users or other entities and checks whether they have permission to perform requested operations. ### Source excerpt The difference between who gets to access (AuthN) a Kubernetes cluster and what they can do with those permissions (AuthZ) ## Secure Apache Airflow Using Customer Security Manager DevFeed: [Secure Apache Airflow Using Customer Security Manager]() Original publisher: [Read original article]() Author: Yifei Sun Published: 2022-01-19T20:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [airflow](), [Security](), [Access Control](), [Orchestration](), [Multitenancy]() Tags: [access-control](), [airflow](), [apache](), [authz](), [data-science](), [http](), [multi-tenancy](), [security](), [web]() ### AI overview This article describes Square's security requirements for running Apache Airflow in a multi-tenant environment. It explains using a human proxy to pass user identities and capabilities to the Airflow web console through HTTP headers, supporting automatic login and role- and DAG-level access control without offline permission synchronization. ### Source excerpt Leverage a human proxy to auto log users in airflow web console