이 문서에서는 Azure용 GKE에 Google 그룹의 구성원으로 연결하는 방법을 설명합니다.
Google 그룹을 사용하여 클러스터 액세스 권한을 부여하는 것이 개별 사용자에 대해 별도의 승인을 생성하는 것보다 더 효율적입니다. 예를 들어 클러스터 관리자 그룹에 사용자 50명, 편집자 그룹에 사용자 75명, 리더 그룹에 사용자 100명을 추가한다고 가정해 보겠습니다. 이러한 모든 사용자가 클러스터에 연결할 수 있도록 하려면 Kubernetes 매니페스트 파일에 225명의 사용자에 대한 RBAC 규칙을 만들어야 합니다. 하지만 Google 그룹을 사용하여 클러스터에 대한 액세스를 사용 설정하면 Google 그룹 3개에 대한 RBAC 규칙만 만들면 되므로 시간이 절약됩니다.
프로젝트 도메인에 gke-security-groups라는 그룹이 없으면 이 그룹을 그룹으로 만듭니다.
클러스터 인증을 위해 gke-security-groups 그룹 내에 하위 그룹을 하나 이상 만듭니다.
새로 만든 하위 그룹에 사용자를 추가합니다.
연결 게이트웨이를 사용하여 kubectl에 액세스하려는 경우 Google 그룹에 IAM 역할을 부여해야 합니다.
그룹에 적합한 역할을 선택합니다. 이 역할은 그룹이 연결 게이트웨이와 상호작용하는 방법을 결정합니다. 역할은 roles/gkehub.gatewayAdmin, roles/gkehub.gatewayEditor, roles/gkehub.gatewayReader 중 하나일 수 있습니다.
(여기에서는 클러스터에 대한 권한을 부여하지 않습니다. 이 단계는 나중에 나옵니다.
여기에서는 그룹 사용자가 연결 게이트웨이를 조작할 수 있는 방법만 결정합니다.)
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-29(UTC)"],[],[],null,["# Connect Google groups to GKE on Azure\n=====================================\n\nThis document describes how you can connect to GKE on Azure as a member of a\n[Google group](/iam/docs/groups-in-cloud-console).\n\nUsing Google groups to grant cluster access is more efficient than creating\nseparate authorizations for individual users. For example, let's say you want\nto add 50 users to the cluster Administrator group, 75 users to an Editor group,\nand 100 users to a Reader group. Enabling all these users to connect to your\ncluster would require you to create RBAC rules in the Kubernetes manifest file\nfor 225 users. Enabling access to your cluster with Google groups, however\nsaves you time because you only need to create RBAC rules for three Google\ngroups.\n\nBefore you begin\n----------------\n\nTo connect to your cluster as a member of a Google group, you need to satisfy\nthe following prerequisites:\n\n1. Ensure that you have the latest version of the Google Cloud CLI. For\n information on updating gcloud CLI, see\n [`gcloud components update`](/sdk/gcloud/reference/components/update).\n\n2. Use GKE on Azure version 1.25 or above, which is required for `kubectl`\n access using connect gateway.\n\nConnect to your cluster with Google groups\n------------------------------------------\n\nTo authorize Google groups to connect to GKE on Azure, follow these\nsteps:\n\n1. Enable the `connectgateway` and `cloudresourcemanager` APIs\n with the following command:\n\n gcloud services enable --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n connectgateway.googleapis.com \\\n cloudresourcemanager.googleapis.com\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of your\n Azure project.\n2. Create a group called `gke-security-groups` as a group in your project's\n domain if it doesn't exist.\n\n3. Create one or more sub-groups within the `gke-security-groups` group for\n cluster authentication.\n\n4. Add users to the newly created sub-groups.\n\n5. For `kubectl` access using connect gateway, you need to grant\n IAM roles to Google groups:\n\n 1. Select an appropriate role for a group. This role determines how the\n group interacts with the connect gateway. The role can be\n one of the following: `roles/gkehub.gatewayAdmin`,\n `roles/gkehub.gatewayEditor`, `roles/gkehub.gatewayReader`.\n (Note that you're not granting\n permissions over the cluster here - that step comes later.\n Here, you're just determining how users of the group can manipulate\n the connect gateway.)\n\n 2. Run the following command to grant the role to the group:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=group:\u003cvar translate=\"no\"\u003eGROUP_NAME\u003c/var\u003e@\u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e \\\n --role=\u003cvar translate=\"no\"\u003eGATEWAY_ROLE\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your Google project ID\n - \u003cvar translate=\"no\"\u003eGROUP_NAME\u003c/var\u003e: the name of the group to grant access to\n - \u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e: your Google Workspace domain\n - \u003cvar translate=\"no\"\u003eGATEWAY_ROLE\u003c/var\u003e: the selected role. For example `roles/gkehub.gatewayAdmin`, `roles/gkehub.gatewayEditor`, or `roles/gkehub.gatewayReader`.\n\n | **Note:** To grant `kubectl` access through a private endpoint, follow the preceding steps, but grant `roles/gkemulticloud.viewer` to the Google groups instead.\n6. In a Kubernetes manifest, define the permissions each Google group\n has on the cluster. For example, the following manifest grants the Google\n Group `cluster-admin-team` the role of cluster administrator:\n\n apiVersion: rbac.authorization.k8s.io/v1\n kind: ClusterRoleBinding\n metadata:\n name: gateway-cluster-admin-group\n subjects:\n - kind: Group\n name: cluster-admin-team@example.com\n roleRef:\n kind: ClusterRole\n name: cluster-admin\n apiGroup: rbac.authorization.k8s.io\n\n7. Save the manifest to a file and apply it to the cluster by running the\n following command:\n\n kubectl apply -kubeconfig=\u003cvar translate=\"no\"\u003eKUBECONFIG_PATH\u003c/var\u003e -f \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKUBECONFIG_PATH\u003c/var\u003e: the path to your `kubeconfig` file.\n - \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e: the name of the manifest file you created.\n\nOnce you've performed these steps, users belonging to certain Google groups can\nconnect to the cluster. In the given example, users belonging to the Google\ngroup `cluster-admin-team` can connect to the cluster as administrators."]]
