Securing Kubernetes Namespace & Cluster Access

Regulated financial institutions (hedge funds, investment banks, market makers) host latency-sensitive execution pods, pricing services, and quantitative analytics engines on Kubernetes. Native Kubernetes RBAC lacks real-time revocation, is cluster-scoped, and leads to credential sprawl. AuthHub introduces a dual-track governance substrate:

Platform Engineers, Quantitative Developers, SREs, and Compliance Auditors are synchronized from enterprise IdPs (Okta, Microsoft Entra ID) into AuthHub via the SCIM 2.0 Ingress (/scim/v2/Users and /scim/v2/Groups).

AuthHub models the Kubernetes estate as a four-tier securables hierarchy (infrastructure_region → k8s_cluster → k8s_namespace → k8s_workload), differentiating read-only inspection from intrusive container execution.

definition user {}

definition platform_team {
    relation cluster_admin: user
    relation sre_lead: user
    relation compliance_auditor: user
}

definition k8s_cluster {
    relation platform: platform_team
    relation auditor: user
}

definition k8s_namespace {
    relation parent_cluster: k8s_cluster
    relation namespace_admin: user
    relation developer: user
    relation automated_pod: user
    relation tier0_restricted: user

    // Pod and resource read permissions
    permission view_workloads = developer + namespace_admin + parent_cluster->platform->cluster_admin
    permission view_logs = developer + namespace_admin + parent_cluster->platform->compliance_auditor

    // Container exec / attach requires explicit administrative or JIT delegation,
    // and is completely forbidden if the namespace carries tier0_restricted status.
    permission exec_container = (namespace_admin + parent_cluster->platform->sre_lead) - tier0_restricted
    permission modify_secrets = namespace_admin
}

definition k8s_workload {
    relation parent_namespace: k8s_namespace
    relation technical_owner: user

    permission restart = technical_owner + parent_namespace->namespace_admin
    permission read_status = parent_namespace->view_workloads
}

{
  "writes": [
    {
      "resource": { "objectType": "k8s_namespace", "objectId": "quant-research-staging" },
      "relation": "developer",
      "subject": { "objectType": "user", "objectId": "usr-scim-alex-quant" }
    }
  ]
}

Regulated workloads (such as algorithmic execution pods, ArgoCD GitOps sync workers, and telemetry daemons) cannot hold static API tokens or cloud IAM secrets mounted in Secret volumes. AuthHub implements RFC 8693 Workload Identity Federation.

apiVersion: v1
kind: Pod
metadata:
  name: algorithmic-pricing-bot
  namespace: prod-trade-execution-tier0
spec:
  serviceAccountName: pricing-engine-sa
  containers:
  - name: bot
    image: 123456789.dkr.ecr.us-east-1.amazonaws.com/pricing-bot:v2.4.1
    volumeMounts:
    - mountPath: /var/run/secrets/tokens
      name: authhub-token
  volumes:
  - name: authhub-token
    projected:
      sources:
      - serviceAccountToken:
          path: authhub-token
          expirationSeconds: 3600
          audience: "https://api.authhub.cloud"

In production financial environments, engineers possess Zero Standing Privileges. Interactive pod shell access (kubectl exec) or namespace administration requires an ephemeral Just-In-Time (JIT) access request.

{
  "resourceType": "k8s_namespace",
  "resourceId": "prod-trade-execution-tier0",
  "requestedRole": "namespace_admin",
  "durationSeconds": 1800,
  "justification": "INC-88912: Order routing gateway socket timeout post-market close",
  "requireDualApproval": true
}

Pre-flight checks alone cannot stop an active session from turning rogue. AuthHub continuously evaluates real-time business telemetry and enforces immediate, streaming session termination:

Under SOX 404, FINRA Rule 3110, and SEC Rule 17a-4, access to production container infrastructure cannot persist unchecked. Compliance teams configure quarterly Cluster Access Recertification Campaigns.

{
  "name": "Q3 2026 Production Kubernetes Namespace & Cluster Access Attestation",
  "scopeFilter": {
    "environment": "production",
    "tier": 0,
    "actorType": "infrastructure"
  },
  "deadline": "2026-10-31T23:59:59.000Z",
  "completionThreshold": 100.0
}

{
  "nhiId": "k8s-ns-prod-trade-exec",
  "newExpiresAt": "2027-01-31T00:00:00Z"
}

{
  "nhiId": "k8s-ns-retired-fx-arb",
  "reason": "Strategy decommissioned in Q2 portfolio rebalance"
}