Google Cloud には、フリートとフリートで実行されるアプリケーションを保護するための幅広い機能が用意されています。このページでは、フリートのセキュリティ機能の概要について説明し、詳細情報へのリンクを示します。
ID を管理する
Google Cloud には、クラスタが存在する場所を問わず、シンプルで一貫した安全な方法でフリート クラスタに対する認証を行うための次のオプションが用意されています。認証を設定したら、Kubernetes ロールベース アクセス制御（RBAC）を使用して、クラスタに対してより詳細なアクセス制御を構成できます。
Google Cloudによる認証
Google Cloud 上のすべての GKE クラスタは、 Google Cloud のユーザー ID とサービス アカウント ID をデフォルトで受け入れるように構成されています。フリートに複数の環境のクラスタが含まれている場合は、Connect Gateway を構成して、ユーザーとサービス アカウントが Google Cloud ID を使用して登録済みのクラスタに対して認証できるようにすることができます。
既存のサードパーティの ID プロバイダを使用してフリート クラスタに対する認証を行う場合は、GKE Identity Service が既存の ID ソリューションを複数の環境に導入できるようにする認証サービスです。Okta や Microsoft AD FS などすべての OpenID Connect（OIDC）プロバイダと、一部の環境における LDAP プロバイダのプレビュー サポートをサポートしています。GKE Identity Service は、クラスタ単位で設定できます。また、サポートされている場合は、フリート全体に対して 1 つの構成で設定できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-08 UTC。"],[],[],null,["Google Cloud provides a range of features to secure your fleet and the applications that run on it. This page provides an overview of fleet security features, with links to find out more.\n\nManage identity\n\nGoogle Cloud provides the following options for authenticating to fleet clusters\nin a simple, consistent, and secured way, wherever the clusters live. After you\nhave set up authentication, you can configure more fine-grained access control\nto your clusters using [Kubernetes role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\n\nAuthenticate with Google Cloud\n\nAll GKE clusters on Google Cloud are configured to accept Google Cloud user and service account identities by default. If your fleet contains clusters in multiple environments, you can configure the [Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway) so that users and service accounts can also authenticate to any registered cluster using their Google Cloud ID.\n\nLearn more about setting up and using authentication with Google Cloud in the following guides:\n\n- [Configuring cluster access for `kubectl`](/kubernetes-engine/docs/how-to/cluster-access-for-kubectl)\n- [Connecting to registered clusters with the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway)\n- [Setting up the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway/setup)\n- [Using the Connect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway/using)\n\nAuthenticate with third-party providers\n\nIf you want to use your existing third-party identity provider to authenticate to your fleet clusters, GKE Identity Service is an authentication service that lets you bring your existing identity solutions to multiple environments. It supports all [OpenID Connect (OIDC)](https://openid.net/connect/) providers such as Okta and Microsoft AD FS, as well as preview support for LDAP providers in some environments. You can set up GKE Identity Service on a cluster-by-cluster basis or with [a single configuration for your entire fleet](/kubernetes-engine/enterprise/identity/setup/fleet), where supported.\n\nLearn more about setting up and using third-party authentication, including supported environments and providers, in the following guides:\n\n- [Introducing GKE Identity Service](/kubernetes-engine/enterprise/identity)\n- [Accessing clusters with GKE Identity Service](/kubernetes-engine/enterprise/identity/accessing)\n\nAuthenticate with a bearer token\n\nIf the preceding Google-provided solutions aren't suitable for\nyour organization, you can set up authentication using a Kubernetes service\naccount and using its bearer token to log in. For details,\nsee [Set up using a bearer token](/kubernetes-engine/enterprise/identity/setup/bearer-token-auth).\n\nManage fleet security\n\nGoogle Cloud provides a range of features and products that improve the security\nof your fleets and workloads, such as the following:\n\n- Binary Authorization to ensure that only trusted images are deployed on your fleet clusters\n- Kubernetes network policies to control connections between Pods\n- Fine-grained service access control for Cloud Service Mesh\n- The GKE security posture dashboard to monitor your clusters' security posture.\n\nMonitor fleet security posture\n\nThe GKE security posture dashboard helps you assess and\nmanage your fleet's GKE clusters for security concerns and get actionable\nrecommendations to fix them. Capabilities include [configuration auditing](/kubernetes-engine/docs/concepts/about-configuration-scanning).\n\nThe dashboard displays discovered concerns for all of the clusters in the\nselected fleet and for any standalone GKE clusters in the selected\nproject.\n\n- For details and a full list of capabilities, see [About the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard).\n- For pricing information, see [GKE security posture dashboard pricing](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#pricing).\n\nConfigure security posture dashboard features at fleet level\n\nYou can manage some security dashboard features at fleet level, so that all the clusters in your fleet can use the same default settings for security observability.\n\n- Learn how to [configure security posture dashboard features](/kubernetes-engine/docs/how-to/fleet-security-posture) for your fleet.\n\nFleet security resources\n\nLearn more about fleet security features in the following guides:\n\n- [Binary Authorization](/binary-authorization/docs/overview)\n- [Kubernetes network policies](/kubernetes-engine/docs/tutorials/network-policy)\n- Application security in Cloud Service Mesh:\n - [Authorization policy overview](/service-mesh/docs/security/authorization-policy-overview)\n - [Configuring transport security](/service-mesh/docs/security/configuring-mtls)\n - [Monitoring mesh security](/service-mesh/docs/observability/monitor-mesh-security)\n- [About the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard)\n\nManage cluster policies\n\n[Policy Controller](/anthos-config-management/docs/concepts/policy-controller) enables the enforcement of fully programmable\npolicies for your fleet clusters. These policies act as \"guardrails\" and prevent any\nchanges to the configuration of the Kubernetes API from violating security,\noperational, or compliance controls.\n\nLearn more about what you can do with Policy Controller in the [Policy Controller documentation](/anthos-config-management/docs/concepts/policy-controller)."]]
