The flow, step by step Once, beforehand: prints.example registers at photos.example, and gets a client_id (public) and a client_secret (kept on its server). alice clicks Import from photos.example at prints.example. prints.example redirects her browser to photos.example's /authorize, with its client_id, the scope it …

The flow, step by step Once, at startup: prints.example reads photos.example's discovery document, then its public keys. alice clicks Sign in with photos.example at prints.example. prints.example redirects her browser to photos.example's /authorize, as in OAuth2, with scope=openid profile email and a nonce. alice signs …

A bearer token replaces the session's record with a signature. curl sends the password once, to /login, inside TLS. The server answers with a token: the claims (who, which role, until when, for which services), signed with the server's private key. curl sends the token with every request, as Authorization: Bearer …

A Service gives a group of pods one address that lasts as long as the Service, while the pods behind it come and go. The cluster is the Pod Network's. First a pod is replaced under a client that held its address. Then one Service, web, grows through its three types: ClusterIP: an address inside the cluster, for pods; …

Every node in a Kubernetes cluster has one address on the network the nodes share, and every pod an address of its own, from its node's range. The cluster is the Top View's. We follow a packet from pod to pod: on one node, then across two. Then a network policy filters it. Kubernetes sets the rules for this network, …

Kubernetes sets the rules for the cluster's network and implements none of them itself. A network plug-in keeps them, and every cluster keeps the same rules, whichever plug-in it runs: Calico, Cilium, Flannel, or a cloud's own, such as the Amazon VPC CNI on EKS. What differs from one plug-in to the next is how it keeps …

A home or café router has one public address and gives its clients private ones, so it rewrites every packet that crosses it. On the way out, it rewrites the source. On the way back, it rewrites the destination. The NAT table, in the pane on the right, is what drives both. Step runs the clock to the next event, through …

TCP numbers every byte it sends, and every ACK names the next byte it expects, so each acknowledgment can be traced back to the segments it covers. Host A sends from left to right, Host B from right to left. Step plays six scenes, one after another: the handshake, data and close; a lost segment and its retransmission; …

HTTP keeps nothing between requests, so a server that wants to know who is asking must be told on every request. Basic authentication, defined in RFC 7617, does it the simplest way: every request carries the username and password in a header. The tool shows each message whole, so the password can be read crossing the …

A session moves the password off the wire. The browser sends the password once, in a login form. The server creates a record, "this random id belongs to alice", and hands the id back in a cookie. The browser returns the cookie on every request, and the server looks the id up to learn who is asking. It follows Basic …