Basic (CSV) Authentication to the API Server

HTTP basic authentication on a Kubernetes API server is a quick way to grant individual users scoped access without issuing client certificates. The setup involves creating a CSV credentials file, mounting it into the kube-apiserver static pod, enabling the --basic-auth-file flag, and wiring up RBAC roles so each user gets exactly the permissions they need.

Prerequisites

• A single-node or multi-node cluster created with kubeadm
• Access to the control-plane node(s)
• Kubernetes version 1.18 or earlier

Step 1: Create the User Details File

Create a CSV file on the control-plane node at /tmp/users/user-details.csv:

password123,user1,u0001
password123,user2,u0002
password123,user3,u0003
password123,user4,u0004
password123,user5,u0005

The format is password,username,uid.

Step 2: Mount the File into the kube-apiserver Pod

Edit the static pod manifest at /etc/kubernetes/manifests/kube-apiserver.yaml.

Add a volume and volume mount so the CSV is available inside the container:

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    # ... existing flags ...
    - --basic-auth-file=/tmp/users/user-details.csv
    image: k8s.gcr.io/kube-apiserver-amd64:v1.11.3
    name: kube-apiserver
    volumeMounts:
    - mountPath: /tmp/users
      name: usr-details
      readOnly: true
  volumes:
  - hostPath:
      path: /tmp/users
      type: DirectoryOrCreate
    name: usr-details

Key changes:

• --basic-auth-file=/tmp/users/user-details.csv tells the API server where to read credentials.
• volumeMounts / volumes bind-mounts the host directory into the container.

Step 3: Create a Role and RoleBinding

Apply the following to grant user1 read access to pods in the default namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: user1
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Step 4: Verify Authentication

Test the credentials against the API server:

curl -v -k https://localhost:6443/api/v1/pods -u "user1:password123"

A successful response returns a JSON list of pods in the default namespace.

References

• etcd Recovery Guide

• Technology
• Security

• Kubernetes
• SysAdmin