2V0-71.23 Question 219
Select 2You are a Kubernetes administrator responsible for managing user access to Tanzu Kubernetes Grid (TKG) clusters in your organization. The organization requires centralized authentication and fine-grained role-based access control (RBAC). Which authentication and authorization methods can be used to meet these requirements?
- A
Integrate the TKG cluster with an external Identity Provider (IdP) using OpenID Connect (OIDC).
- B
Manually create Kubernetes ServiceAccounts for each user to handle authentication.
- C
Use Kubernetes RoleBindings and ClusterRoleBindings to assign permissions to users and groups.
- D
Configure kubeconfig files with user-specific certificates for authentication.
- E
Use LDAP integration directly within the TKG cluster for authentication and authorization.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the organization’s requirements for centralized authentication and fine-grained RBAC, integrating the TKG cluster with an external IdP using OIDC ensures centralized user authentication. Additionally, Kubernetes RoleBindings and ClusterRoleBindings provide the ability to manage authorization, enabling fine-grained control over access to resources. Other methods, like ServiceAccounts or user-specific certificates, do not meet the centralization or scalability requirements, and LDAP integration is not directly supported without an external IdP.
- A. Correct.
Integrating the TKG cluster with an external Identity Provider (IdP) using OpenID Connect (OIDC) provides centralized authentication and integrates with enterprise identity solutions, meeting the requirement for centralized authentication.
- B. Incorrect.
Manually creating Kubernetes ServiceAccounts for each user is not recommended for managing user authentication, as ServiceAccounts are meant for workload authentication, not users. This approach lacks scalability and centralized management.
- C. Correct.
Kubernetes RoleBindings and ClusterRoleBindings are used to manage authorization by assigning permissions to users or groups, fulfilling the requirement for fine-grained RBAC.
- D. Incorrect.
Using kubeconfig files with user-specific certificates for authentication is a valid method but does not provide centralized authentication, making it unsuitable for the given requirements.
- E. Incorrect.
LDAP integration is not natively supported within the TKG cluster for both authentication and authorization. Instead, LDAP can be integrated with an external IdP, which can then be used with OIDC for authentication.