AKE can perform webhook token authentication on user requests to access clusters. The AKE user manager synchronizes user authentication information to AKE workload clusters. When a user accesses a cluster by using the user's dedicated kubeconfig file, the request is authenticated by the warden authentication service based on authentication token information.
The AKE user manager includes User Controller and ClusterToken Controller running in the AKE management cluster, and the warden authentication service running in AKE workload clusters, and defines User CR and ClusterToken CR.
User CR is used to describe a user synchronized from AOC.
ClusterToken CR is used to describe authentication token information for a user to access a cluster, and is used to generate the user's kubeconfig.
