Google Distributed Cloud 支持将 OpenID Connect (OIDC) 和轻量级目录访问协议 (LDAP) 用作身份验证机制，以便使用 GKE Identity Service 与集群的 Kubernetes API 服务器进行交互。GKE Identity Service 是一项身份验证服务，可让您将用于身份验证的现有身份解决方案部署到多个 GKE Enterprise 环境。用户可以使用现有的身份提供方，通过命令行（所有提供方）或Google Cloud 控制台（仅限 OIDC）登录和使用 GKE 集群。
GKE Identity Service 适用于任何类型的 Bare Metal 集群：管理员、用户、混合或独立集群。您可以使用本地和可公开访问的身份提供商。例如，如果您的企业运行 Active Directory 联合身份验证服务 (ADFS) 服务器，则 ADFS 服务器可以充当您的 OpenID 提供方。您还可以使用 Okta 等可公开访问的身份提供方服务。身份提供方证书可以由知名公共证书授权机构 (CA) 或私有 CA 颁发。
按照为舰队级 GKE Identity Service 配置集群（预览版，Google Distributed Cloud 1.8 版及更高版本）中的说明在舰队级层配置集群。如果使用此选项，您的身份验证配置由 Google Cloud集中管理。
按照使用 OIDC 为 GKE Identity Service 配置集群中的说明单独配置集群。由于舰队级设置是预览版功能，因此如果您使用的是早期版本的 Google Distributed Cloud 或者需要舰队级生命周期管理尚不支持的 GKE Identity Service 功能，则建议您在生产环境中使用此选项。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-01。"],[],[],null,["Google Distributed Cloud supports [OpenID Connect\n(OIDC)](https://openid.net/connect/) and [Lightweight Directory\nAccess Protocol (LDAP)](https://ldap.com/) as authentication\nmechanisms for interacting with a cluster's Kubernetes API server, using\nGKE Identity Service. GKE Identity Service is an authentication service\nthat lets you bring your existing identity solutions for authentication to\nyour clusters. Users can log in to and use clusters from the command line\n(all providers) or from the Google Cloud console (OIDC only), all using your\nexisting identity provider.\n\nGKE Identity Service works with any kind of bare metal cluster: admin, user,\nhybrid, or standalone. You can use both on-premises and publicly reachable\nidentity providers. For example, if your enterprise runs an [Active Directory\nFederation Services\n(ADFS)](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)\nserver, the ADFS server could serve as your OpenID provider. You might also use\npublicly-reachable identity provider services such as Okta. Identity provider\ncertificates may be issued by either a well-known public certificate authority\n(CA), or by a private CA.\n| **Note:** The GKE Identity Service runs as a Pod inside the cluster control plane. During cluster lifecycle phases, the API Server is dynamically configured to use the in-cluster GKE Identity Service as the authentication webhook for all incoming requests. The API Server [isn't able to use in-cluster\n| DNS](https://github.com/kubernetes/minikube/issues/3772). As a result, the API Server is configured to access GKE Identity Service as a REST resource access. In audit logs, this invocation is recorded as a `CREATE` request to the Services or proxy resource by a `system:anonymous` user.\n\nFor an overview of how GKE Identity Service works, see [Introducing\nGKE Identity Service](/kubernetes-engine/enterprise/identity).\n\nIf you already use or want to use Google IDs to sign in to your GKE clusters\ninstead of an OIDC or LDAP provider, we recommend using connect gateway\nfor authentication. Find out more in [Connecting to registered clusters with the\nconnect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway).\n\nBefore you begin\n\n- To prompt users for consent and authorize their user account, a\n browser-based authentication flow is used. Headless systems aren't\n supported.\n\n- To authenticate through the Google Cloud console, each cluster that you want to\n configure must be [registered with your project\n fleet](/kubernetes-engine/fleet-management/docs/fleet-creation).\n\nSetup process and options\n\nGKE Identity Service supports identity providers using the following\nprotocols:\n\n- [OpenID Connect (OIDC)](https://openid.net/connect/). We provide\n specific instructions for setup for some popular OpenID providers, including\n Microsoft, but you can use any provider that implements OIDC.\n\n- [Lightweight Directory Access Protocol\n (LDAP)](https://ldap.com/). You can use\n GKE Identity Service to authenticate using LDAP with Active Directory\n or an LDAP server.\n\nOIDC\n\n1. Register GKE Identity Service as a client with your OIDC provider\n following the instructions in [Configuring providers for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/provider).\n\n2. Choose from the following cluster configuration options:\n\n - Configure your clusters at fleet level following the instructions in\n [Configuring clusters for fleet-level\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/fleet-cluster) (preview,\n Google Distributed Cloud version 1.8 and higher). With this option, your\n authentication configuration is centrally managed by Google Cloud.\n\n - Configure your clusters individually following the instructions in\n [Configuring clusters for GKE Identity Service with\n OIDC](/kubernetes-engine/enterprise/identity/setup/per-cluster). Because fleet-level setup is\n a preview feature, you may want to use this option in production\n environments, if you are using an earlier version of\n Google Distributed Cloud, or if you require GKE Identity Service\n features that aren't yet supported with fleet-level lifecycle\n management.\n\n3. Set up user access to your clusters, including role-based access control\n (RBAC), following the instructions in [Setting up user access for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/user-access).\n\nLDAP\n\nTo get started with LDAP, follow the instructions in [Set up\nGKE Identity Service with\nLDAP](/kubernetes-engine/enterprise/identity/setup/ldap).\n\nAccess clusters\n\nAfter GKE Identity Service has been set up, users can sign in to configured\nclusters using either the command line or the Google Cloud console.\n\n- Learn how to sign in to registered clusters with your OIDC or LDAP ID in\n [Accessing clusters using\n GKE Identity Service](/kubernetes-engine/enterprise/identity/accessing).\n\n- Learn how to sign in to clusters from the Google Cloud console in [Work\n with clusters from the\n Google Cloud console](/kubernetes-engine/fleet-management/docs/console)\n (OIDC only).\n\nTroubleshoot the login flow\n\nTo troubleshoot [login flows that authenticate directly on the\nGKE Identity Service server with a fully qualified domain name\n(FQDN)](/kubernetes-engine/enterprise/identity/setup/authenticate-fqdn-access),\nyou can use the GKE Identity Service diagnostic utility. The diagnostic\nutility simulates login flows with your OIDC provider to quickly identify\nconfiguration problems. This tool requires a version 1.32 or higher cluster and\nonly supports OIDC. For more information, see [GKE Identity Service\ndiagnostic\nutility](/kubernetes-engine/enterprise/identity/setup/anthos-v2-diagnostic-utility)."]]
