--- title: Kubernetes Authentication: Users and Workload Identities description: A deep dive into how the Kubernetes API server authenticates requests, covering the distinction between external users and internal workload identities. It... canonical: https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes Authentication: Users and Workload Identities | daily.dev og:description: A deep dive into how the Kubernetes API server authenticates requests, covering the distinction between external users and internal workload identities. It... og:url: https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy og:image: https://api.daily.dev/og/posts/g6xeq0TwY.png og:image:alt: Kubernetes Authentication: Users and Workload Identities og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Authentication: Users and Workload Identities **[LearnKube](https://daily.dev/sources/learnkube)** · 28 min read · 0 upvotes · 0 comments ## Summary A deep dive into how the Kubernetes API server authenticates requests, covering the distinction between external users and internal workload identities. It walks through static token files, X.509 certificates, Service Accounts, projected/JWT tokens, the TokenRequest API, and the Token Review API, plus how AWS IRSA and EKS Pod Identity exchange Kubernetes Service Account tokens for temporary AWS credentials via OIDC federation. It closes with practical guidance on choosing an authentication plugin for production use. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I generate a short-lived token for a Kubernetes Service Account without creating a Secret? Use the kubectl create token command, for example `kubectl -n authn-demo create token test --duration=10m`, which calls the TokenRequest API to issue a bounded-lifetime JWT without mounting a projected volume or creating a Secret. The API server may return a shorter or longer lifetime than requested, and running the command again produces a different token. _daily.dev surfaces practical Kubernetes authentication guides for engineers hardening cluster access._ ### What is the difference between a Kubernetes Service Account token created via a Secret versus the TokenRequest API? Secret-based tokens are static, never expire, and are created asynchronously which can cause race conditions right after Service Account creation; TokenRequest tokens are short-lived, can be scoped to specific audiences, bound to objects like Pods, and rotate automatically via the kubelet. TokenReview responses for Secret tokens also omit the authentication.kubernetes.io/credential-id extra field that appears on TokenRequest tokens. _Teams comparing Service Account token strategies can track these Kubernetes patterns on daily.dev._ ### How does AWS IRSA let a Kubernetes pod assume an IAM role without contacting the Kubernetes API server? The pod receives a projected Service Account token with sts.amazonaws.com as its audience, and the AWS SDK exchanges that JWT plus a role ARN for temporary credentials via AWS STS AssumeRoleWithWebIdentity. AWS STS verifies the token's issuer, audience, subject and signature against the OIDC discovery document and JWKS endpoint published by the EKS cluster, without ever calling the Kubernetes API directly. _daily.dev helps engineers wiring up AWS IAM and Kubernetes workload identity keep the OIDC details straight._ ## Similar posts on daily.dev - [How to Authenticate Users in Kubernetes: x509 Certificates, OIDC, and Cloud Identity](https://daily.dev/posts/how-to-authenticate-users-in-kubernetes-x509-certificates-oidc-and-cloud-identity-hxgchmocb) · freeCodeCamp · 1 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-vbssgzntz) · Medium · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#authentication](https://daily.dev/tags/authentication), [#aws-iam](https://daily.dev/tags/aws-iam) [View this post on daily.dev](https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes Authentication: Users and Workload Identities","url":"https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy"},"datePublished":"2026-08-31T11:20:04.035Z","dateModified":"2026-08-31T11:20:43.750Z","description":"A deep dive into how the Kubernetes API server authenticates requests, covering the distinction between external users and internal workload identities. It...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/345b677859b3e1f48b9bbadeb0f0df34?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/345b677859b3e1f48b9bbadeb0f0df34?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LearnKube","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LearnKube","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90786df1b5d44abb91a090a0b6c81517","url":"https://daily.dev/sources/learnkube"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,authentication,aws-iam","timeRequired":"PT28M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LearnKube","item":"https://daily.dev/sources/learnkube"},{"@type":"ListItem","position":3,"name":"Kubernetes Authentication: Users and Workload Identities"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-authentication-users-and-workload-identities-g6xeq0twy#faq","mainEntity":[{"@type":"Question","name":"How do I generate a short-lived token for a Kubernetes Service Account without creating a Secret?","acceptedAnswer":{"@type":"Answer","text":"Use the kubectl create token command, for example `kubectl -n authn-demo create token test --duration=10m`, which calls the TokenRequest API to issue a bounded-lifetime JWT without mounting a projected volume or creating a Secret. The API server may return a shorter or longer lifetime than requested, and running the command again produces a different token. daily.dev surfaces practical Kubernetes authentication guides for engineers hardening cluster access."}},{"@type":"Question","name":"What is the difference between a Kubernetes Service Account token created via a Secret versus the TokenRequest API?","acceptedAnswer":{"@type":"Answer","text":"Secret-based tokens are static, never expire, and are created asynchronously which can cause race conditions right after Service Account creation; TokenRequest tokens are short-lived, can be scoped to specific audiences, bound to objects like Pods, and rotate automatically via the kubelet. TokenReview responses for Secret tokens also omit the authentication.kubernetes.io/credential-id extra field that appears on TokenRequest tokens. Teams comparing Service Account token strategies can track these Kubernetes patterns on daily.dev."}},{"@type":"Question","name":"How does AWS IRSA let a Kubernetes pod assume an IAM role without contacting the Kubernetes API server?","acceptedAnswer":{"@type":"Answer","text":"The pod receives a projected Service Account token with sts.amazonaws.com as its audience, and the AWS SDK exchanges that JWT plus a role ARN for temporary credentials via AWS STS AssumeRoleWithWebIdentity. AWS STS verifies the token's issuer, audience, subject and signature against the OIDC discovery document and JWKS endpoint published by the EKS cluster, without ever calling the Kubernetes API directly. daily.dev helps engineers wiring up AWS IAM and Kubernetes workload identity keep the OIDC details straight."}}]} ```