Google Distributed Cloud는 GKE Identity Service를 사용하여 OpenID Connect(OIDC) 및 경량 디렉터리 액세스 프로토콜(LDAP)을 클러스터의 Kubernetes API와 상호작용하기 위한 인증 메커니즘으로 지원합니다. GKE Identity Service는 인증을 위한 기존 ID 솔루션을 여러 GKE Enterprise 환경에 적용할 수 있게 해주는 인증 서비스입니다. 명령줄(모든 공급업체) 또는Google Cloud 콘솔(OIDC만 해당)에서 모두 기존 ID 공급업체를 사용하여 GKE 클러스터에 로그인하고 이를 사용할 수 있습니다.
GKE Identity Service는 관리자, 사용자, 하이브리드 또는 독립형 등 모든 종류의 베어메탈 클러스터에서 작동합니다. 온프레미스 및 공개적으로 연결 가능한 ID 공급업체 모두 사용할 수 있습니다. 예를 들어 기업에서 Active Directory Federation Services(ADFS) 서버를 실행하는 경우 ADFS 서버가 OpenID 제공업체 역할을 할 수 있습니다. Okta와 같은 공개적으로 연결 가능한 ID 공급업체 서비스를 사용할 수도 있습니다. ID 공급업체 인증서는 잘 알려진 공공 인증 기관(CA) 또는 민간 CA에서 발급받을 수 있습니다.
OIDC 또는 LDAP 제공업체 대신 GKE 클러스터에 로그인하기 위해 Google ID를 이미 사용 중이거나 사용하려는 경우에는 인증에 Connect Gateway를 사용하는 것이 좋습니다. 자세한 내용은 Connect Gateway를 사용하여 등록된 클러스터에 연결을 참조하세요.
시작하기 전에
사용자 동의를 구하고 사용자 계정을 승인하기 위해 브라우저 기반 인증 흐름이 사용됩니다. 헤드리스 시스템은 지원되지 않습니다.
Google Cloud 콘솔을 통해 인증하려면 구성하려는 각 클러스터가 프로젝트 Fleet에 등록되어 있어야 합니다.
설정 프로세스 및 옵션
GKE Identity Service는 다음 프로토콜을 사용하여 ID 공급업체를 지원합니다.
OpenID Connect(OIDC). Google에서는 Microsoft를 비롯한 일부 인기 있는 OpenID 제공업체의 설정을 위한 구체적인 안내를 제공하지만 개발자는 OIDC를 구현하는 모든 제공업체를 사용할 수 있습니다.
경량 디렉터리 액세스 프로토콜(LDAP). GKE Identity Service를 사용하면 Active Directory의 LDAP 또는 LDAP 서버를 사용하여 인증할 수 있습니다.
OIDC로 GKE Identity Service를 위한 클러스터 구성의 안내에 따라 클러스터를 개별적으로 구성합니다. Fleet 수준 설정은 미리보기 기능이므로 이전 버전의 Google Distributed Cloud를 사용하거나 아직 Fleet 수준 수명 주기 관리로 지원되지 않는 GKE ID 서비스 기능이 필요한 경우 프로덕션 환경에서 이 옵션을 사용하는 것이 좋습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-01(UTC)"],[],[],null,["Google Distributed Cloud supports [OpenID Connect\n(OIDC)](https://openid.net/connect/) and [Lightweight Directory\nAccess Protocol (LDAP)](https://ldap.com/) as authentication\nmechanisms for interacting with a cluster's Kubernetes API server, using\nGKE Identity Service. GKE Identity Service is an authentication service\nthat lets you bring your existing identity solutions for authentication to\nyour clusters. Users can log in to and use clusters from the command line\n(all providers) or from the Google Cloud console (OIDC only), all using your\nexisting identity provider.\n\nGKE Identity Service works with any kind of bare metal cluster: admin, user,\nhybrid, or standalone. You can use both on-premises and publicly reachable\nidentity providers. For example, if your enterprise runs an [Active Directory\nFederation Services\n(ADFS)](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)\nserver, the ADFS server could serve as your OpenID provider. You might also use\npublicly-reachable identity provider services such as Okta. Identity provider\ncertificates may be issued by either a well-known public certificate authority\n(CA), or by a private CA.\n| **Note:** The GKE Identity Service runs as a Pod inside the cluster control plane. During cluster lifecycle phases, the API Server is dynamically configured to use the in-cluster GKE Identity Service as the authentication webhook for all incoming requests. The API Server [isn't able to use in-cluster\n| DNS](https://github.com/kubernetes/minikube/issues/3772). As a result, the API Server is configured to access GKE Identity Service as a REST resource access. In audit logs, this invocation is recorded as a `CREATE` request to the Services or proxy resource by a `system:anonymous` user.\n\nFor an overview of how GKE Identity Service works, see [Introducing\nGKE Identity Service](/kubernetes-engine/enterprise/identity).\n\nIf you already use or want to use Google IDs to sign in to your GKE clusters\ninstead of an OIDC or LDAP provider, we recommend using connect gateway\nfor authentication. Find out more in [Connecting to registered clusters with the\nconnect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway).\n\nBefore you begin\n\n- To prompt users for consent and authorize their user account, a\n browser-based authentication flow is used. Headless systems aren't\n supported.\n\n- To authenticate through the Google Cloud console, each cluster that you want to\n configure must be [registered with your project\n fleet](/kubernetes-engine/fleet-management/docs/fleet-creation).\n\nSetup process and options\n\nGKE Identity Service supports identity providers using the following\nprotocols:\n\n- [OpenID Connect (OIDC)](https://openid.net/connect/). We provide\n specific instructions for setup for some popular OpenID providers, including\n Microsoft, but you can use any provider that implements OIDC.\n\n- [Lightweight Directory Access Protocol\n (LDAP)](https://ldap.com/). You can use\n GKE Identity Service to authenticate using LDAP with Active Directory\n or an LDAP server.\n\nOIDC\n\n1. Register GKE Identity Service as a client with your OIDC provider\n following the instructions in [Configuring providers for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/provider).\n\n2. Choose from the following cluster configuration options:\n\n - Configure your clusters at fleet level following the instructions in\n [Configuring clusters for fleet-level\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/fleet-cluster) (preview,\n Google Distributed Cloud version 1.8 and higher). With this option, your\n authentication configuration is centrally managed by Google Cloud.\n\n - Configure your clusters individually following the instructions in\n [Configuring clusters for GKE Identity Service with\n OIDC](/kubernetes-engine/enterprise/identity/setup/per-cluster). Because fleet-level setup is\n a preview feature, you may want to use this option in production\n environments, if you are using an earlier version of\n Google Distributed Cloud, or if you require GKE Identity Service\n features that aren't yet supported with fleet-level lifecycle\n management.\n\n3. Set up user access to your clusters, including role-based access control\n (RBAC), following the instructions in [Setting up user access for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/user-access).\n\nLDAP\n\nTo get started with LDAP, follow the instructions in [Set up\nGKE Identity Service with\nLDAP](/kubernetes-engine/enterprise/identity/setup/ldap).\n\nAccess clusters\n\nAfter GKE Identity Service has been set up, users can sign in to configured\nclusters using either the command line or the Google Cloud console.\n\n- Learn how to sign in to registered clusters with your OIDC or LDAP ID in\n [Accessing clusters using\n GKE Identity Service](/kubernetes-engine/enterprise/identity/accessing).\n\n- Learn how to sign in to clusters from the Google Cloud console in [Work\n with clusters from the\n Google Cloud console](/kubernetes-engine/fleet-management/docs/console)\n (OIDC only).\n\nTroubleshoot the login flow\n\nTo troubleshoot [login flows that authenticate directly on the\nGKE Identity Service server with a fully qualified domain name\n(FQDN)](/kubernetes-engine/enterprise/identity/setup/authenticate-fqdn-access),\nyou can use the GKE Identity Service diagnostic utility. The diagnostic\nutility simulates login flows with your OIDC provider to quickly identify\nconfiguration problems. This tool requires a version 1.32 or higher cluster and\nonly supports OIDC. For more information, see [GKE Identity Service\ndiagnostic\nutility](/kubernetes-engine/enterprise/identity/setup/anthos-v2-diagnostic-utility)."]]
