Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Google Distributed Cloud mendukung OpenID Connect (OIDC) dan Lightweight Directory Access Protocol (LDAP) sebagai
mekanisme autentikasi untuk berinteraksi dengan server Kubernetes API cluster, menggunakan GKE Identity Service. GKE Identity Service adalah layanan autentikasi yang memungkinkan Anda membawa solusi identitas yang sudah ada untuk autentikasi ke beberapa lingkungan cluster. Pengguna dapat login dan menggunakan cluster Anda dari command line (semua penyedia) atau dari Google Cloud konsol (khusus OIDC), semuanya menggunakan penyedia identitas Anda yang sudah ada.
Anda dapat menggunakan penyedia identitas yang dapat dijangkau secara publik dan di tempat dengan GKE Identity Service. Misalnya, jika perusahaan Anda menjalankan server
Active Directory Federation Services (ADFS), server ADFS dapat berfungsi sebagai penyedia OpenID Anda. Anda juga dapat menggunakan layanan penyedia identitas yang dapat dijangkau secara publik seperti Okta. Sertifikat penyedia identitas dapat diterbitkan oleh certificate authority (CA) publik yang terkenal, atau oleh CA pribadi.
Jika Anda sudah menggunakan atau ingin menggunakan ID Google untuk login ke cluster GKE, bukan penyedia OIDC atau LDAP, sebaiknya gunakan gateway Connect untuk autentikasi. Cari tahu selengkapnya di Menghubungkan ke cluster terdaftar dengan gateway Connect.
Konfigurasi cluster Anda di tingkat fleet dengan mengikuti petunjuk di Mengonfigurasi cluster untuk GKE Identity Service tingkat fleet (pratinjau, Google Distributed Cloud versi 1.8 dan yang lebih tinggi). Dengan opsi ini, konfigurasi autentikasi Anda dikelola secara terpusat oleh Google Cloud.
Konfigurasi setiap cluster secara terpisah dengan mengikuti petunjuk di Mengonfigurasi cluster untuk GKE Identity Service dengan OIDC. Karena penyiapan tingkat fleet adalah fitur pratinjau, Anda dapat menggunakan opsi ini di lingkungan produksi, jika Anda menggunakan Google Distributed Cloud versi yang lebih lama, atau jika Anda memerlukan fitur GKE Identity Service yang belum didukung dengan pengelolaan siklus proses tingkat fleet.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["Google Distributed Cloud supports [OpenID Connect (OIDC)](https://openid.net/connect/) and [Lightweight Directory Access Protocol (LDAP)](https://ldap.com/) as\nauthentication mechanisms for interacting with a cluster's Kubernetes API\nserver, using GKE Identity Service. GKE Identity Service is an authentication service that lets you bring your existing identity solutions for authentication to multiple GKE Enterprise environments. Users can log in to and use your GKE clusters from the command line (all providers) or from the Google Cloud console (OIDC only), all using your existing identity provider.\n\nYou can use both on-premises and publicly reachable identity providers with GKE Identity Service. For example, if your enterprise runs an\n[Active Directory Federation Services (ADFS)](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)\nserver, the ADFS server could serve as your OpenID provider. You might also use publicly-reachable identity provider services such as Okta. Identity provider certificates may be issued by either a well-known public certificate authority (CA), or by a private CA.\n| **Note:** The GKE Identity Service runs as a Pod inside the cluster control plane. During cluster lifecycle phases, the API Server is dynamically configured to use the in-cluster GKE Identity Service as the authentication webhook for all incoming requests. The API Server [isn't able to use in-cluster\n| DNS](https://github.com/kubernetes/minikube/issues/3772). As a result, the API Server is configured to access GKE Identity Service as a REST resource access. In audit logs, this invocation is recorded as a `CREATE` request to the Services or proxy resource by a `system:anonymous` user.\n\nFor an overview of how GKE Identity Service works, see [Introducing GKE Identity Service](/anthos/identity).\n\nIf you already use or want to use Google IDs to log in to your GKE clusters instead of an OIDC or LDAP provider, we recommend using the Connect gateway for authentication. Find out more in [Connecting to registered clusters with the Connect gateway](/anthos/multicluster-management/gateway).\n\nSetup process and options\n\nOIDC\n\n1. Register GKE Identity Service as a client with your OIDC provider following the instructions in [Configuring providers for GKE Identity Service](/anthos/identity/setup/provider).\n\n2. Choose from the following cluster configuration options:\n\n - Configure your clusters at fleet level following the instructions in [Configuring clusters for fleet-level GKE Identity Service](/anthos/identity/setup/fleet-cluster) (preview, Google Distributed Cloud version 1.8 and higher). With this option, your authentication configuration is centrally managed by Google Cloud.\n - Configure your clusters individually following the instructions in [Configuring clusters for GKE Identity Service with OIDC](/anthos/identity/setup/per-cluster). Because fleet-level setup is a preview feature, you may want to use this option in production environments, if you are using an earlier version of Google Distributed Cloud, or if you require GKE Identity Service features that aren't yet supported with fleet-level lifecycle management.\n3. Set up user access to your clusters, including role-based access control (RBAC), following the instructions in [Setting up user access for GKE Identity Service](/anthos/identity/setup/user-access).\n\nLDAP\n\n- Follow the instructions in [Set up GKE Identity Service with LDAP](/anthos/identity/setup/ldap).\n\nAccessing clusters\n\nAfter GKE Identity Service has been set up, users can log in to configured clusters using either the command line or the Google Cloud console.\n\n- Learn how to log in to registered clusters with your OIDC or LDAP ID in [Accessing clusters using GKE Identity Service](/anthos/identity/accessing).\n- Learn how to log in to clusters from the Google Cloud console in [Logging in to a cluster from the Google Cloud console](/anthos/multicluster-management/console/logging-in) (OIDC only).\n\nTroubleshoot the login flow\n\nTo troubleshoot [login flows that authenticate directly on the\nGKE Identity Service server with a fully qualified domain name\n(FQDN)](/kubernetes-engine/enterprise/identity/setup/authenticate-fqdn-access),\nyou can use the GKE Identity Service diagnostic utility. The diagnostic\nutility simulates login flows with your OIDC provider to quickly identify\nconfiguration problems. This tool requires a version 1.32 or higher cluster and\nonly supports OIDC. For more information, see [GKE Identity Service\ndiagnostic\nutility](/kubernetes-engine/enterprise/identity/setup/anthos-v2-diagnostic-utility)."]]
