Administrar la identidad con el Servicio de identidad de GKE
Organízate con las colecciones
Guarda y clasifica el contenido según tus preferencias.
GKE en AWS admite OpenID Connect (OIDC) y AWS IAM como mecanismo de autenticación para interactuar con el servidor de API de Kubernetes de un clúster mediante el Servicio de Identidad de GKE. Este servicio le permite integrar sus soluciones de identidad existentes en múltiples entornos. Los usuarios pueden iniciar sesión y usar sus clústeres de GKE desde la línea de comandos o desde...Google Cloud consola, todo utilizando su proveedor de identidad existente.
Si ya usas o quieres usar identidades de Google para iniciar sesión en tus clústeres de GKE, te recomendamos usar el comando gcloud containers aws clusters get-credentials para la autenticación. Obtén más información en "Conectarse y autenticarse en el clúster" .
Para autenticarse a través de la Google Cloud En la consola, debe registrar cada clúster que desee configurar con su flota de proyectos. Para GKE en AWS, esto es automático una vez creado el grupo de nodos.
Para permitir que los usuarios se autentiquen a través de Google Cloud En la consola, asegúrese de que todos los clústeres que desea configurar estén registrados en la flota de su proyecto . Para GKE en AWS, esto es automático una vez creado el grupo de nodos.
Una vez configurado el servicio de identidad de GKE en un clúster, los usuarios pueden iniciar sesión en los clústeres mediante la línea de comandos o el Google Cloud consola.
Reemplace KUBECONFIG_PATH con la ruta al archivo kubeconfig de su clúster; por ejemplo, $HOME/.kube/config .
Su editor de texto carga el recurso ClientConfig de su clúster. Agregue el objeto spec.authentication.aws como se muestra a continuación. No modifique ningún dato predeterminado que ya se haya escrito.
Una vez configurado el servicio de identidad de GKE en un clúster, los usuarios pueden iniciar sesión en los clústeres mediante la línea de comandos o el Google Cloud consola.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-06-12 (UTC)."],[],[],null,["# Manage identity with GKE Identity Service\n\nGKE on AWS supports\n[OpenID Connect (OIDC)](https://openid.net/connect/)\nand\n[AWS IAM](https://aws.amazon.com/iam/) as an\nauthentication mechanism for interacting with a cluster's Kubernetes API\nserver, using GKE Identity Service. GKE Identity Service is an\nauthentication service that lets you bring your existing identity solutions for\nauthentication to multiple environments. Users can log in to and\nuse your GKE clusters from the command line or from the\nGoogle Cloud console, all using your existing identity provider.\n\nFor an overview of how GKE Identity Service works, see\n[Introducing GKE Identity Service](/anthos/identity).\n\nIf you already use or want to use Google identities to log in to your\nGKE clusters, we recommend using the\n`gcloud containers aws clusters get-credentials` command for authentication. Find out\nmore in\n[Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster#google-identity).\n\nOpenID Connect authentication\n-----------------------------\n\n### Before you begin\n\n1. To use OIDC authentication, users must be able to connect to the cluster's control\n plane. See\n [Connect to your cluster's control plane](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster#connect-to-vpn).\n\n2. To authenticate through the Google Cloud console, you must\n [register each cluster](/anthos/multicluster-management/connect/registering-a-cluster)\n that you want to configure with your project fleet. For GKE on AWS,\n this is automatic once you have created a node pool.\n\n3. To allow users to authenticate through the Google Cloud console, ensure that all\n clusters you want to configure are\n [registered with your project fleet](/anthos/multicluster-management/connect/registering-a-cluster).\n For GKE on AWS, this is automatic once you have created a node pool.\n\n### Setup process and options\n\n1. Register GKE Identity Service as a client with your OIDC provider\n following the instructions in\n [Configuring providers for GKE Identity Service](/anthos/identity/setup/provider).\n\n2. Choose from the following cluster configuration options:\n\n - Configure your clusters at the fleet-level following the instructions in\n [Configuring clusters for fleet-level GKE Identity Service](/anthos/identity/setup/fleet-cluster).\n With this option, your authentication configuration is centrally managed by\n Google Cloud.\n\n - Configure your clusters individually following the instructions in\n [Configuring clusters for GKE Identity Service with OIDC](/anthos/identity/setup/per-cluster).\n\n3. Set up user access to your clusters, including role-based access control\n (RBAC), following the instructions in\n [Setting up user access for GKE Identity Service](/anthos/identity/setup/user-access).\n\n### Accessing clusters\n\nAfter GKE Identity Service has been set up on a cluster, users can log in\nto clusters using either the command line or the Google Cloud console.\n\n- Learn how to log in to registered clusters with your OIDC ID in [Accessing clusters using GKE Identity Service](/anthos/identity/accessing).\n- Learn how to log in to clusters from the Google Cloud console in [Logging in to a cluster from the Google Cloud console](/anthos/multicluster-management/console/logging-in).\n\nAWS IAM authentication\n----------------------\n\nThe AWS IAM support on GKE on AWS uses\n[GKE Identity Service](/anthos/identity).\n\n### Before you begin\n\nTo use AWS IAM authentication, users must be able to connect to the cluster's control\nplane. See\n[Connect to your cluster's control plane](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster#connect-to-vpn).\n\n### Setup process and options\n\nTo configure your cluster to allow AWS IAM authentication for a particular AWS region,\ndo the following:\n\n1. Edit the `ClientConfig` resource on your cluster:\n\n kubectl --kubeconfig=\u003cvar translate=\"no\"\u003eKUBECONFIG_PATH\u003c/var\u003e edit ClientConfigs default -n kube-public\n\n Replace \u003cvar translate=\"no\"\u003eKUBECONFIG_PATH\u003c/var\u003e with the path to your\n cluster's kubeconfig file---for example `$HOME/.kube/config`.\n\n Your text editor loads your cluster's ClientConfig resource. Add the\n `spec.authentication.aws` object as shown below. Do not modify any\n default data that has already been written. \n\n apiVersion: authentication.gke.io/v2alpha1\n kind: ClientConfig\n metadata:\n name: default\n namespace: kube-public\n spec:\n authentication:\n - name: \u003cvar name=\"name\" translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAME\u003c/span\u003e\u003c/var\u003e\n aws:\n region: \u003cvar name=\"aws region\" translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eAWS_REGION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: an arbitrary name of this authentication method. e.g. \"aws-iam\".\n - \u003cvar translate=\"no\"\u003eAWS_REGION\u003c/var\u003e: the AWS region where the user info is retrieved. It needs to match the region configured on your users' AWS CLI.\n2. To enable your cluster users to use AWS IAM, follow\n [Setting up user access for GKE Identity Service](/anthos/identity/setup/user-access).\n\n### Accessing clusters\n\nAfter GKE Identity Service has been set up on a cluster, users can log in\nto clusters using either the command line or the Google Cloud console.\n\nTo learn how to log in to registered clusters with your AWS IAM identity, see\n[Accessing clusters using GKE Identity Service](/anthos/identity/accessing)."]]