Connect로 Google Cloud 콘솔을 사용하여 로그인하기 위해 GKE on AWS는 Kubernetes 서비스 계정의 Bearer 토큰을 사용할 수 있습니다. 자세한 내용은 Google Cloud 콘솔에서 클러스터에 로그인을 참조하세요.
Kubernetes API 서버 및 ID 토큰
클러스터로 인증한 후에는 gcloud CLI의 kubectl CLI를 사용하여 상호작용할 수 있습니다. kubectl이 사용자를 대신하여 Kubernetes API 서버를 호출하면 API 서버는 OpenID 제공업체의 공개 인증서를 사용하여 토큰을 확인합니다. 그런 다음 API 서버는 토큰을 파싱하여 사용자의 ID와 사용자의 보안 그룹을 학습합니다.
API 서버는 사용자의 보안 그룹을 클러스터의 역할 기반 액세스 제어(RBAC) 정책과 비교하여 사용자가 이 특정 호출을 수행할 수 있는지 확인합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Authentication\n\nGKE on AWS supports the following authentication methods:\n\n- Connect\n- OpenID Connect (OIDC).\n\nConnect\n-------\n\nTo log in using the Google Cloud console with Connect,\nGKE on AWS can use a Kubernetes service account's bearer token. For\nmore information, see\n[Logging in to a cluster from the Google Cloud console](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/connecting-to-a-cluster).\n\n### The Kubernetes API server and the ID token\n\nAfter authenticating with the cluster, you can interact using the `kubectl` CLI\nof gcloud CLI. When `kubectl` calls the Kubernetes API server on behalf\nof the user, the API server verifies the token by using the OpenID provider's\npublic certificate. Then the API server parses the token to learn the user's\nidentity and the user's security groups.\n\nThe API server determines whether the user is authorized to make this particular\ncall by comparing the user's security groups to the cluster's\n[role-based Access Control](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)\n(RBAC) policy.\n\nOIDC\n----\n\nGKE on AWS supports OIDC authentication with the\n[GKE Identity Service](/anthos/identity). GKE Identity Service\nsupports many identity providers. For more information, see\n[Supported identity providers](/anthos/identity#supported_identity_providers).\n\n### Overview\n\nWith OIDC, you can manage access to a cluster with the standard procedures in\nyour organization for creating, enabling, and disabling employee accounts. You\ncan also use your organization's security groups to configure access to a\nKubernetes cluster or to specific services in the cluster.\n\nA typical OIDC login flow follows:\n\n- A user signs in to an OpenID provider by presenting a username and\n password.\n\n- The OpenID provider signs and issues an ID token for the user.\n\n- The gcloud CLI sends an HTTPS request to the Kubernetes API server.\n The application includes the user's ID token in the request header.\n\n- The Kubernetes API server verifies the token by using the provider's\n certificate.\n\n### Signing in with the gcloud CLI\n\nYou run the `gcloud anthos auth login` command to authenticate with your\nclusters. The gcloud CLI authenticates your request to the Kubernetes\nAPI server.\n\nTo use the gcloud CLI, your OIDC ID tokens must be stored in the\n[`kubeconfig` file](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/).\nYou add tokens to your `kubeconfig` file with\n[`gcloud anthos create-login-config`](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/oidc#create_a_login_config).\nGKE on AWS uses the gcloud CLI to request and\nobtain the ID token and other OIDC values in the `kubeconfig` file."]]
