借助 GKE Multi-Cloud API，集群管理员可以创建、更新和删除集群和节点池。您可以使用 Identity and Access Management (IAM) 管理 API 的权限。如需使用 API，用户必须拥有适当的权限。如需了解每项操作所需的权限，请参阅 API 角色和权限。IAM 可让您定义角色并将其分配给主账号。角色可提供一组权限，当分配给主账号时，它可控制对一个或多个 Google Cloud资源的访问权限。
在组织、文件夹或项目中创建集群或节点池时，在该组织、文件夹或项目中具有适当权限的用户可以修改这些内容。例如，如果您在Google Cloud 项目级层为用户提供集群删除权限，则该用户可以删除该项目中的任何集群。如需了解详情，请参阅 Google Cloud 资源层次结构和创建 IAM 政策。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Authentication overview\n\nThis page describes how GKE on AWS handles authentication to\nGoogle Cloud and user authentication to your clusters.\n\nHow GKE on AWS connects to AWS\n------------------------------\n\nFor more information on how GKE on AWS uses AWS IAM roles to connect to\nAWS, see [AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/concepts/aws-iam-roles).\n\nAuthentication\n--------------\n\n### GKE Multi-Cloud API authentication\n\nYou use the GKE Multi-Cloud API to create, update, and delete clusters\nand node pools. As with other Google Cloud APIs, you can use this\nAPI with REST, Google Cloud CLI, or the Google Cloud console.\n\nFor more information, see\n[Google Cloud authentication overview](/docs/authentication)\nand the [GKE Multi-Cloud API](/kubernetes-engine/multi-cloud/docs/reference/rest)\nreference documentation.\n\n### Kubernetes API authentication\n\nYou can use the `kubectl` command-line tool to perform cluster operations such\nas deploying a workload and configuring a load balancer. The `kubectl` tool\nconnects to the Kubernetes API on your cluster's control plane. To call this\nAPI, you need to authenticate with authorized credentials.\n\nTo get credentials, you can use one of the following methods:\n\n- [Google Identity](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster#google-identity),\n which lets users log in using their Google Cloud identity. Use this option if\n your users already have access to Google Cloud with a Google Identity.\n\n- [GKE Identity Service](/kubernetes-engine/multi-cloud/docs/aws/how-to/anthos-identity-service),\n which lets users log in using OpenID Connect\n (OIDC) or AWS IAM.\n\nGKE Identity Service lets you use identity providers such as\n[Okta](https://www.okta.com/),\n[Active Directory Federation Services (ADFS)](https://docs.microsoft.com/windows-server/identity/active-directory-federation-services),\nor any\n[OIDC](https://openid.net/connect/)\ncompliant identity provider.\n\nAuthorization\n-------------\n\nGKE on AWS has two methods for access control, the GKE Multi-Cloud API and\n[role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\nThis section describes the differences between these methods.\n\nIt's best to take a layered approach to protecting your clusters and workloads.\nYou can apply the\n[principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege)\nto the level of access that you provide to your users and workloads. You might\nneed to make tradeoffs to allow the right level of flexibility and security.\n\n### GKE Multi-Cloud API access control\n\nThe GKE Multi-Cloud API lets cluster administrators create, update, and delete clusters\nand node pools. You manage permissions for the API with\nIdentity and Access Management (IAM). To use the API, users must have the appropriate\npermissions. For the permissions necessary for each\noperation, see [API roles and permissions](/kubernetes-engine/multi-cloud/docs/aws/reference/api-permissions).\nIAM lets you define [roles](/iam/docs/understanding-roles)\nand assign them to\n[principals](/iam/docs/overview#concepts_related_identity).\nA role is a collection of permissions, and when assigned to a principal, controls\naccess to one or more Google Cloud\n[resources](/iam/docs/overview#resource).\n\nWhen you create a cluster or node pool in an organization, folder, or project,\nusers with appropriate permissions in that organization, folder, or project can\nmodify it. For example, if you give a user a cluster deletion permission at a\nGoogle Cloud project level, that user can delete any cluster in that\nproject. For more information, see\n[Google Cloud resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy) and\n[Creating IAM policies](/kubernetes-engine/docs/how-to/iam).\n\n### Kubernetes API access control\n\nThe Kubernetes API lets you manage\n[Kubernetes objects](https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/).\nTo manage access control on the Kubernetes API, you use role-based access\ncontrol (RBAC). For more information, see\n[Configuring role-based access control](/kubernetes-engine/docs/how-to/role-based-access-control)\nin the GKE documentation.\n\n#### Administrator access\n\nWhen you use the gcloud CLI to create a cluster, by default the\nGKE Multi-Cloud API adds your user account as an administrator and creates\nappropriate RBAC policies that grant you full administrative access to the\ncluster. To configure different users, pass the\n[`--admin-users`](/sdk/gcloud/reference/container/aws/clusters/create#--admin-users)\nflag when you create or update a cluster. When you use the `--admin-users` flag,\nyou must include all users that can administer the cluster. The\ngcloud CLI doesn't include the user that creates the cluster.\n\nYou can also add admin users using the Google Cloud console. For more\ninformation, see\n[Update your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/update-cluster#update_your_cluster).\n| **Note:** When you add admin users, the GKE Multi-Cloud API applies the Kubernetes RBAC policies to the cluster to grant the users the same administrative access that you were granted when you created the cluster. These policies grant users the Kubernetes `clusterrole/cluster-admin` role, which provides full access to every resource in the cluster in all namespaces.\n\nTo see the configuration of your cluster's access, run the following command: \n\n kubectl describe clusterrolebinding gke-multicloud-cluster-admin\n\nIn addition to the RBAC policies to access the Kubernetes API server, if an\nadmin user isn't a project owner, you need to grant specific IAM\nroles that let the admin users authenticate using their Google identity. For\nmore information about how to connect to the cluster, see\n[Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster).\n\nWhat's next\n-----------\n\n- To set up OIDC, see [Manage identity with GKE Identity Service](/kubernetes-engine/multi-cloud/docs/aws/how-to/anthos-identity-service).\n- [Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster)."]]
