Google Cloud 는 Fleet과 Fleet에서 실행되는 애플리케이션을 보호하기 위한 다양한 기능을 제공합니다. 이 페이지에서는 Fleet 보안 기능을 간략히 설명하고 자세한 내용을 확인할 수 있는 링크를 제공합니다.
ID 관리
Google Cloud 에서는 클러스터가 있는 위치와 관계없이 간단하고 일관되며 안전한 방식으로 Fleet 클러스터에 인증할 수 있는 다음 옵션을 제공합니다. 인증을 설정한 후에는 Kubernetes 역할 기반 액세스 제어(RBAC)를 사용하여 클러스터에 대한 액세스 제어를 더욱 세분화하여 구성할 수 있습니다.
Google Cloud로 인증
Google Cloud 의 모든 GKE 클러스터는 기본적으로 Google Cloud 사용자 및 서비스 계정 ID를 수락하도록 구성됩니다. Fleet에 여러 환경의 클러스터가 포함된 경우 사용자와 서비스 계정도 Google Cloud ID를 사용하여 등록된 클러스터에 인증할 수 있도록 Connect 게이트웨이를 구성할 수 있습니다.
다음 가이드에서 Google Cloud 를 사용한 인증 설정 및 사용에 대해 자세히 알아보세요.
기존 타사 ID 공급업체를 사용해서 Fleet 클러스터에 인증을 수행하려는 경우 GKE Identity Service가 인증 서비스로 사용되어 기존 ID 솔루션을 여러 환경에 제공할 수 있습니다. Okta 및 Microsoft AD FS와 같은 모든 OpenID Connect(OIDC) 공급자와 일부 환경의 LDAP 공급자를 위한 프리뷰 지원을 지원합니다. GKE Identity Service를 클러스터별로 또는 전체 Fleet에 대한 단일 구성(지원되는 경우)으로 설정할 수 있습니다.
다음 가이드에서 지원되는 환경과 제공업체를 포함하여 타사 인증 설정 및 사용을 자세히 알아봅니다.
GKE Compliance 대시보드는 CIS GKE 벤치마크 및 Kubernetes 포드 보안 표준과 같은 업계 표준에 따른 클러스터 규정 준수 개요를 제공합니다. 대시보드는 규정 준수 보고를 자동화하고 발견된 문제에 대한 자세한 목록과 실행 가능한 권장사항을 제공합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-22(UTC)"],[],[],null,["Google Cloud provides a range of features to secure your fleet and the applications that run on it. This page provides an overview of fleet security features, with links to find out more.\n\nManage identity\n\nGoogle Cloud provides the following options for authenticating to fleet clusters\nin a simple, consistent, and secured way, wherever the clusters live. After you\nhave set up authentication, you can configure more fine-grained access control\nto your clusters using [Kubernetes role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\n\nAuthenticate with Google Cloud\n\nAll GKE clusters on Google Cloud are configured to accept Google Cloud user and service account identities by default. If your fleet contains clusters in multiple environments, you can configure the [Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway) so that users and service accounts can also authenticate to any registered cluster using their Google Cloud ID.\n\nLearn more about setting up and using authentication with Google Cloud in the following guides:\n\n- [Configuring cluster access for `kubectl`](/kubernetes-engine/docs/how-to/cluster-access-for-kubectl)\n- [Connecting to registered clusters with the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway)\n- [Setting up the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway/setup)\n- [Using the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway/using)\n\nAuthenticate with third-party providers\n\nIf you want to use your existing third-party identity provider to authenticate to your fleet clusters, GKE Identity Service is an authentication service that lets you bring your existing identity solutions to multiple environments. It supports all [OpenID Connect (OIDC)](https://openid.net/connect/) providers such as Okta and Microsoft AD FS, as well as preview support for LDAP providers in some environments. You can set up GKE Identity Service on a cluster-by-cluster basis or with [a single configuration for your entire fleet](/kubernetes-engine/enterprise/identity/setup/fleet), where supported.\n\nLearn more about setting up and using third-party authentication, including supported environments and providers, in the following guides:\n\n- [Introducing GKE Identity Service](/kubernetes-engine/enterprise/identity)\n- [Accessing clusters with GKE Identity Service](/kubernetes-engine/enterprise/identity/accessing)\n\nAuthenticate with a bearer token\n\nIf the preceding Google-provided solutions aren't suitable for\nyour organization, you can set up authentication using a Kubernetes service\naccount and using its bearer token to log in. For details,\nsee [Set up using a bearer token](/kubernetes-engine/enterprise/identity/setup/bearer-token-auth).\n\nManage fleet security\n\nGoogle Cloud provides a range of features and products that improve the security\nof your fleets and workloads, such as the following:\n\n- Binary Authorization to ensure that only trusted images are deployed on your fleet clusters\n- Kubernetes network policies to control connections between Pods\n- Fine-grained service access control for Cloud Service Mesh\n- The GKE security posture dashboard to monitor your clusters' security posture.\n\nMonitor fleet security posture\n\nThe GKE security posture dashboard helps you assess and\nmanage your fleet's GKE clusters for security concerns and get actionable\nrecommendations to fix them. Capabilities include [configuration auditing](/kubernetes-engine/docs/concepts/about-configuration-scanning).\n\nThe dashboard displays discovered concerns for all of the clusters in the\nselected fleet and for any standalone GKE clusters in the selected\nproject.\n\n- For details and a full list of capabilities, see [About the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard).\n- For pricing information, see [GKE security posture dashboard pricing](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#pricing).\n\nConfigure security posture dashboard features at fleet level\n\nYou can manage some security dashboard features at fleet level, so that all the clusters in your fleet can use the same default settings for security observability.\n\n- Learn how to [configure security posture dashboard features](/kubernetes-engine/docs/how-to/fleet-security-posture) for your fleet.\n\nFleet security resources\n\nLearn more about fleet security features in the following guides:\n\n- [Binary Authorization](/binary-authorization/docs/overview)\n- [Kubernetes network policies](/kubernetes-engine/docs/tutorials/network-policy)\n- Application security in Cloud Service Mesh:\n - [Authorization policy overview](/service-mesh/docs/security/authorization-policy-overview)\n - [Configuring transport security](/service-mesh/docs/security/configuring-mtls)\n - [Monitoring mesh security](/service-mesh/docs/observability/monitor-mesh-security)\n- [About the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard)\n\nManage cluster policies\n\n[Policy Controller](/anthos-config-management/docs/concepts/policy-controller) enables the enforcement of fully programmable\npolicies for your fleet clusters. These policies act as \"guardrails\" and prevent any\nchanges to the configuration of the Kubernetes API from violating security,\noperational, or compliance controls.\n\nLearn more about what you can do with Policy Controller in the [Policy Controller documentation](/anthos-config-management/docs/concepts/policy-controller)."]]
