叢集管理員可透過 GKE Multi-Cloud API 建立、更新及刪除叢集和節點集區。您可以使用 Identity and Access Management (IAM) 管理 API 的權限。使用者必須具備適當權限，才能使用 API。如要瞭解各項作業所需的權限，請參閱「API 角色和權限」。IAM 可讓您定義角色，並將角色指派給主體。角色其實就是一組權限，指派給主體後，即可控制一或多項 Google Cloud
資源的存取權。
在機構、資料夾或專案中建立叢集或節點集區時，機構、資料夾或專案中具備適當權限的使用者可以修改叢集或節點集區。舉例來說，如果您在Google Cloud 專案層級授予使用者叢集刪除權限，該使用者就能刪除專案中的任何叢集。詳情請參閱Google Cloud 資源階層和「建立 IAM 政策」。
Kubernetes API 存取權控管
您可以使用 Kubernetes API 管理 Kubernetes 物件。如要管理 Kubernetes API 的存取權控管，請使用角色型存取權控管 (RBAC)。詳情請參閱 GKE 說明文件中的設定角色型存取權控管。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-22 (世界標準時間)。"],[],[],null,["# Authentication overview\n=======================\n\nThis page describes how GKE on Azure handles authentication to\nGoogle Cloud and user authentication to your clusters.\n\nHow GKE on Azure connects to Azure\n----------------------------------\n\nThe GKE Multi-Cloud API authenticates to Azure with an\n*AzureClient* object. When you create a client, Google generates an\n[X.509](https://wikipedia.org/wiki/X.509) key pair.\nYou upload the public key to Azure Active Directory (Azure AD).\n\nFor more information, see\n[Create an AzureClient](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-client).\n\nAuthentication\n--------------\n\n### GKE Multi-Cloud API authentication\n\nYou use the GKE Multi-Cloud API to create, update, and delete clusters\nand node pools. As with other Google Cloud APIs, you can use this\nAPI with REST, Google Cloud CLI, or the Google Cloud console.\n\nFor more information, see\n[Google Cloud authentication overview](/docs/authentication)\nand the [GKE Multi-Cloud API](/kubernetes-engine/multi-cloud/docs/reference/rest)\nreference documentation.\n\n### Kubernetes API authentication\n\nYou can use the `kubectl` command-line tool to perform cluster operations such\nas deploying a workload and configuring a load balancer. The `kubectl` tool\nconnects to the Kubernetes API on your cluster's control plane. To call this\nAPI, you need to authenticate with authorized credentials.\n\nTo get credentials, you can use one of the following methods:\n\n- [Google Identity](/kubernetes-engine/multi-cloud/docs/azure/how-to/connect-and-authenticate-to-your-cluster#google-identity),\n which lets users log in using their Google Cloud identity. Use this option if\n your users already have access to Google Cloud with a Google Identity.\n\n- [GKE Identity Service](/kubernetes-engine/multi-cloud/docs/azure/how-to/anthos-identity-service),\n which lets users log in using OpenID Connect\n (OIDC).\n\nGKE Identity Service lets you use identity providers such as\n[Okta](https://www.okta.com/),\n[Active Directory Federation Services (ADFS)](https://docs.microsoft.com/windows-server/identity/active-directory-federation-services),\nor any\n[OIDC](https://openid.net/connect/)\ncompliant identity provider.\n\nAuthorization\n-------------\n\nGKE on Azure has two methods for access control, the GKE Multi-Cloud API and\n[role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\nThis section describes the differences between these methods.\n\nIt's best to take a layered approach to protecting your clusters and workloads.\nYou can apply the\n[principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege)\nto the level of access that you provide to your users and workloads. You might\nneed to make tradeoffs to allow the right level of flexibility and security.\n\n### GKE Multi-Cloud API access control\n\nThe GKE Multi-Cloud API lets cluster administrators create, update, and delete clusters\nand node pools. You manage permissions for the API with\nIdentity and Access Management (IAM). To use the API, users must have the appropriate\npermissions. For the permissions necessary for each\noperation, see [API roles and permissions](/kubernetes-engine/multi-cloud/docs/azure/reference/api-permissions).\nIAM lets you define [roles](/iam/docs/understanding-roles)\nand assign them to\n[principals](/iam/docs/overview#concepts_related_identity).\nA role is a collection of permissions, and when assigned to a principal, controls\naccess to one or more Google Cloud\n[resources](/iam/docs/overview#resource).\n\nWhen you create a cluster or node pool in an organization, folder, or project,\nusers with appropriate permissions in that organization, folder, or project can\nmodify it. For example, if you give a user a cluster deletion permission at a\nGoogle Cloud project level, that user can delete any cluster in that\nproject. For more information, see\n[Google Cloud resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy) and\n[Creating IAM policies](/kubernetes-engine/docs/how-to/iam).\n\n### Kubernetes API access control\n\nThe Kubernetes API lets you manage\n[Kubernetes objects](https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/).\nTo manage access control on the Kubernetes API, you use role-based access\ncontrol (RBAC). For more information, see\n[Configuring role-based access control](/kubernetes-engine/docs/how-to/role-based-access-control)\nin the GKE documentation.\n\n#### Administrator access\n\nWhen you use the gcloud CLI to create a cluster, by default the\nGKE Multi-Cloud API adds your user account as an administrator and creates\nappropriate RBAC policies that grant you full administrative access to the\ncluster. To configure different users, pass the\n[`--admin-users`](/sdk/gcloud/reference/container/azure/clusters/create#--admin-users)\nflag when you create or update a cluster. When you use the `--admin-users` flag,\nyou must include all users that can administer the cluster. The\ngcloud CLI doesn't include the user that creates the cluster.\n\nYou can also add admin users using the Google Cloud console. For more\ninformation, see\n[Update your cluster](/kubernetes-engine/multi-cloud/docs/azure/how-to/update-cluster#update_your_cluster).\n| **Note:** When you add admin users, the GKE Multi-Cloud API applies the Kubernetes RBAC policies to the cluster to grant the users the same administrative access that you were granted when you created the cluster. These policies grant users the Kubernetes `clusterrole/cluster-admin` role, which provides full access to every resource in the cluster in all namespaces.\n\nTo see the configuration of your cluster's access, run the following command: \n\n kubectl describe clusterrolebinding gke-multicloud-cluster-admin\n\nIn addition to the RBAC policies to access the Kubernetes API server, if an\nadmin user isn't a project owner, you need to grant specific IAM\nroles that let the admin users authenticate using their Google identity. For\nmore information about how to connect to the cluster, see\n[Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/azure/how-to/connect-and-authenticate-to-your-cluster).\n\nWhat's next\n-----------\n\n- To set up OIDC, see [Manage identity with GKE Identity Service](/kubernetes-engine/multi-cloud/docs/azure/how-to/anthos-identity-service).\n- [Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/azure/how-to/connect-and-authenticate-to-your-cluster)."]]
