本文档介绍如何以编程方式向 Google Kubernetes Engine 进行身份验证。 如何向 Google Kubernetes Engine 进行身份验证取决于您用于访问 API 的界面以及运行代码的环境。
借助 GKE API，您可以与运行 Kubernetes 的 Google Cloud 基础设施（例如 GKE 集群和节点）进行交互。
如需与 Pod 和 Service 等 Kubernetes 对象进行交互，您必须向 Kubernetes API 进行身份验证，该 API 独立于 GKE API，并由每个集群中的 Kubernetes API 服务器提供。如需了解相关说明，请参阅向 Kubernetes API 服务器进行身份验证。
GKE 客户端库提供以编程方式向 GKE 进行身份验证的高级语言支持。
为了对 Google Cloud API 的调用进行身份验证，客户端库支持应用默认凭据 (ADC)；这些库会在一组指定的位置查找凭据，并使用这些凭据对发送到 API 的请求进行身份验证。借助 ADC，您可以在各种环境（例如本地开发或生产环境）中为您的应用提供凭据，而无需修改应用代码。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Authenticate to GKE\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\n\nThis document describes how to authenticate to Google Kubernetes Engine programmatically. How\nyou authenticate to Google Kubernetes Engine depends on the interface you use to access the API\nand the environment where your code is running.\nThe GKE API lets you interact with the Google Cloud infrastructure that runs Kubernetes, like your GKE clusters and nodes.\n\n\u003cbr /\u003e\n\nTo interact with *Kubernetes objects* like Pods and Services, you must\nauthenticate to the Kubernetes API, which is separate to the\nGKE API and is served by the Kubernetes API server in each\ncluster. For instructions, see\n[Authenticate to the Kubernetes API server](/kubernetes-engine/docs/how-to/api-server-authentication).\n\nTo access other Google Cloud resources like Cloud Storage buckets\nfrom workloads running in GKE, use\n[Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity).\n\n\nFor more information about Google Cloud authentication, see the\n[Authentication methods](/docs/authentication).\n\nAPI access\n----------\n\n\nGKE supports programmatic access. You can access the API in\nthe following ways:\n\n- [Client libraries](#client-libraries)\n- [Google Cloud CLI](#gcloud)\n- [REST](#rest)\n\n### Client libraries\n\n\nThe [GKE client libraries](/kubernetes-engine/docs/reference/libraries) provide\nhigh-level language support for authenticating to GKE\nprogrammatically.\n\n\nTo authenticate calls to Google Cloud APIs, client libraries support\n[Application Default Credentials (ADC)](/docs/authentication/application-default-credentials);\nthe libraries look for credentials in a set of defined locations and use those credentials\nto authenticate requests to the API. With ADC, you can make\ncredentials available to your application in a variety of environments, such as local\ndevelopment or production, without needing to modify your application code.\n\n### Google Cloud CLI\n\n\nWhen you use the [gcloud CLI](/sdk/gcloud/reference/container/clusters) to access\nGKE, you\n[log in to the gcloud CLI](/sdk/docs/authorizing) with a user\naccount, which provides the credentials used by the gcloud CLI commands.\n\n\nIf your organization's security policies prevent user accounts from having the required\npermissions, you can use [service account impersonation](#sa-impersonation).\n\nFor more information, see\n[Authenticate for using the gcloud CLI](/docs/authentication/gcloud).\nFor more information about using the gcloud CLI with GKE,\nsee [the gcloud CLI reference pages](/sdk/gcloud/reference/container/clusters).\n\n\n### REST\n\n\nYou can authenticate to\n[the GKE API](/kubernetes-engine/docs/reference/rest)\nby using your gcloud CLI credentials or by using\n[Application Default Credentials](/docs/authentication/application-default-credentials).\nFor more information about authentication for REST requests, see\n[Authenticate for using REST](/docs/authentication/rest).\nFor information about the types of credentials, see\n[gcloud CLI credentials and ADC credentials](/docs/authentication/gcloud#gcloud-credentials).\n\nWhat's next\n-----------\n\n- [Authenticate to the Kubernetes API server](/kubernetes-engine/docs/how-to/api-server-authentication).\n- [Use external identity providers to authenticate to GKE](/kubernetes-engine/docs/how-to/oidc).\n- [Authenticate to Google Cloud APIs from GKE using Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity).\n- [Learn about access control in GKE and Kubernetes](/kubernetes-engine/docs/concepts/access-control).\n- [Learn about the GKE API and the Kubernetes API](/kubernetes-engine/docs/reference/api-organization).\n- Learn about [Google Cloud authentication methods](/docs/authentication#auth-decision-tree).\n- See a list of [authentication use cases](/docs/authentication/use-cases)."]]
