World map

 

BM

World K6: Guards

Three gates: authn, authz, admission

You will learn: the three checks every kubectl request passes, and how to tell their errors apart.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

At 3 a.m., someone ran kubectl delete on your shop. The cluster said yes. Which question should it have asked first?

Watch

Tap each point on the timeline.

Every kubectl command knocks on the API server’s door. Three gates stand there, one after another. Tap each gate.

Watch

You are here: cluster kind-dev namespace default

Gate 1 is authentication: Gate 1, the ID check: "Who are you?" A certificate or token proves it.. It reads your ID card and learns your name and groups. kubectl auth whoami shows what gate 1 sees.

Try it

Which gate stops each one? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

        Try it

        Pretend to be the CI bot. Ask the cluster for its secrets.

        You are here: cluster kind-dev namespace default
        dev-control-planeOpenManager

        No trays here.

        dev-workerOpen

        No trays here.

        dev-worker2Open

        No trays here.

        Time: +0s (sped up)

        Check

        Three real errors. Each one comes from a different gate.

        Tap the error from gate 2.

        0 of 1 found

        Plain words: Unauthorized is gate 1. Forbidden with “cannot” is gate 2. Forbidden with “violates” is gate 3.

        Predict

        Gate 2 says yes: you may create pods. Can gate 3 still say no?

        You did it!

        You can now name the three gates every request passes.

        Go deeper (optional)

        Kubernetes has no user objects. People come from certificates or a login provider (OIDC). Robots use ServiceAccounts, which are objects. Gate 3 has two halves. Mutating admission may change your object. Then validating admission checks it. Reads like get skip gate 3.

        Real mission

        2. kubectl auth whoami
        3. kubectl get secrets --as=system:serviceaccount:default:default

        0 of 3 steps done · Your ticks are saved.