[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# Connect and authenticate to your cluster\n========================================\n\nThis page explains how to connect and authenticate to GKE on Azure.\n\nYou have multiple options to authenticate to GKE clusters. All\nof the following options assume that the\n[Connect gateway](/anthos/multicluster-management/gateway) or the user is able\nto [connect to your cluster's control plane](#connect-to-vpn):\n\n- [Google identity](#google-identity): The default authentication option\n provided by GKE on Azure without additional configuration.\n\n- [Open ID Connect (OIDC)](#oidc) : Supported by\n [GKE Identity Service](/anthos/identity)\n\nGoogle identity authentication\n------------------------------\n\nBy default, the GKE Multi-Cloud API grants the user who creates the cluster the\nKubernetes\n[role-based access control](https://kubernetes.io/docs/reference/access-authn-authz/authentication/)\n(RBAC) policies that lets the user authenticate with the cluster using their\nGoogle identity. The user who created the cluster can add other users as\n[admin users](/kubernetes-engine/multi-cloud/docs/azure/concepts/authentication#kubernetes_api_access_control)\nwith full administrative access to the cluster.\n\nIn addition to the RBAC permissions policy that grants the\n`clusterrole/cluster-admin` role to admin users, the GKE Multi-Cloud API configures an\n[impersonation policy](https://kubernetes.io/docs/reference/access-authn-authz/authentication/)\nthat authorizes the [Connect agent](/anthos/fleet-management/docs/connect-agent)\nto send requests to the Kubernetes API server on behalf of an admin user.\n\nYou can authenticate to your cluster with your Google identity in the following\nways:\n\n### Use kubectl with identity from the gcloud CLI\n\nYou can use the Google Cloud CLI to create a `kubeconfig` that uses the\nidentity of the user authenticated with `gcloud auth login`. You can then use\n`kubectl` to access the cluster.\n\nFor `kubectl` access when using the Connect gateway, if an admin user isn't a\nproject owner, minimally, the user must be granted the following roles in the\nproject:\n\n- `roles/gkehub.gatewayAdmin`: This role lets a user access the Connect gateway\n API to use `kubectl` to manage the cluster.\n\n - If a user only needs read-only access to connected clusters, you can grant\n `roles/gkehub.gatewayReader` instead.\n\n - If a user needs read / write access to connected clusters, you can\n grant `roles/gkehub.gatewayEditor`.\n\n- `roles/gkehub.viewer`: This role lets a user retrieve cluster `kubeconfigs`.\n\nFor details about the permissions included in these roles, see\n[GKE Hub roles](/iam/docs/understanding-roles#gke-hub-roles) in the\nIAM documentation.\n\nYou can find out more about granting IAM permissions and roles in\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\nAfter an admin user has the required roles, follow the steps in\n[Configure cluster access for kubectl](/kubernetes-engine/multi-cloud/docs/azure/how-to/configure-cluster-access-for-kubectl).\n\n### Use Google Cloud console\n\nAdmin users who aren't project owners and want to interact with clusters using\nthe console need the following roles at a minimum:\n\n- `roles/container.viewer`. This role lets users view the GKE\n Clusters page and other container resources in the Google Cloud console. For\n details about the permissions included in this role, see\n [Kubernetes Engine roles](/iam/docs/understanding-roles#kubernetes-engine-roles)\n in the IAM documentation.\n\n- `roles/gkehub.viewer`. This role lets users view clusters outside\n Google Cloud in the Google Cloud console. Note that this is one\n of the roles required for `kubectl` access. If you already granted this\n role to a user, you don't need to grant it again. For details about the\n permissions included in this role, see\n [GKE Hub roles](/iam/docs/understanding-roles#gke-hub-roles) in the\n IAM documentation.\n\nYou can find out more about granting IAM permissions and roles in\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\nFor information on logging in to the cluster from the console, see\n[Log in using your Google Cloud identity](/anthos/fleet-management/docs/console#log_in_using_your_identity).\n\n### Use Google Groups\n\nTo connect to your cluster as a member of a Google group, see\n[Connect Google groups to GKE on Azure](/kubernetes-engine/multi-cloud/docs/azure/how-to/connect-google-groups).\n\nAuthenticate with OIDC\n----------------------\n\nFor information on authenticating to your cluster with OIDC, see\n[Manage identity with GKE Identity Service](/kubernetes-engine/multi-cloud/docs/azure/how-to/anthos-identity-service#oidc).\n\nAuthenticate with external identities\n-------------------------------------\n\nFor information on authenticating to your cluster with external identities, see\n[Authenticate with external identities](/kubernetes-engine/multi-cloud/docs/azure/how-to/authenticate-external-ids).\n\nConnect to your cluster's control plane\n---------------------------------------\n\nAll GKE on Azure are created in private subnets. All the underlying\ncluster infrastructure (for example, nodes and load balancer endpoints) is\nprovisioned with private\n[RFC 1918](https://tools.ietf.org/html/rfc1918) IP addresses only.\n\nTo manage your cluster directly, you must be able to connect to the control\nplane load balancer of your cluster. If your cluster can't\nconnect directly to your control plane but can make outbound connections, you\ncan connect to the control plane through Connect gateway, a Google-hosted\nreverse proxy to your cluster. For more information, see\n[Connecting to registered clusters with the Connect gateway](/anthos/multicluster-management/gateway).\n\n\nYou can also connect through Azure's\n[ExpressRoute](https://docs.microsoft.com/azure/expressroute/expressroute-introduction)\nservice."]]
