Anthos clusters on AWS (GKE on AWS) supports the following authentication methods:
- Connect
- OpenID Connect (OIDC). For more information, see Authenticating with OIDC.
Connect
To log in using the Google Cloud Console with Connect, Anthos clusters on AWS can use a Kubernetes service account's bearer token. For more information, see Logging in to a cluster from the Cloud Console.
The Kubernetes API server and the ID token
After authenticating with the cluster, you can interact using the kubectl
CLI
of Cloud SDK. When kubectl
calls the Kubernetes API server on behalf
of the user, the API server verifies the token by using the OpenID provider's
public certificate. Then the API server parses the token to learn the user's
identity and the user's security groups.
The API server determines whether the user is authorized to make this particular call by comparing the user's security groups to the cluster's role-based Access Control (RBAC) policy.
OIDC
This section assumes you are familiar with OAuth 2.0 and OpenID Connect. You should also be familiar with scopes and claims in the context of OpenID authentication.
Overview
With OIDC, you can manage access to a Kubernetes cluster with the standard procedures in your organization for creating, enabling, and disabling employee accounts. You can also use your organization's security groups to configure access to a Kubernetes cluster or to specific services in the cluster.
A typical OIDC login flow follows:
A user signs in to an OpenID provider by presenting a username and password.
The OpenID provider signs and issues an ID token for the user.
The
gcloud
tool sends an HTTPS request to the Kubernetes API server. The application includes the user's ID token in the request header.The Kubernetes API server verifies the token by using the provider's certificate.
If your enterprise runs an Active Directory Federation Services (ADFS) server, the ADFS server could serve as your OpenID provider. Another option is to use a third party as your OpenID provider. For example, Google, Microsoft, Facebook, and Twitter are all OpenID providers.
Signing in with the gcloud
tool
You run the gcloud anthos auth login
command to authenticate with your
clusters. The gcloud
tool authenticates your request to the Kubernetes
API server.
To use the gcloud
tool, your OIDC ID tokens must be stored in the
kubeconfig
file.
You add tokens to your kubeconfig
file with
gcloud anthos create-login-config
.
Anthos clusters on AWS uses the gcloud
tool to request and
obtain the ID token and other OIDC values in the kubeconfig
file.