Set up clusters with GKE Identity Service at a fleet level

OIDC

1. Select New Open ID Connectto create a new OIDC configuration.
2. Specify the name you want to use to identify this configuration in the Provider namefield, typically the identity provider name. This name must start with a letter followed by up to 39 lowercase letters, numbers, or hyphens, and cannot end with a hyphen. You cannot edit this name once you've created a configuration.
3. Specify the client ID returned when registering GKE Identity Service with your provider in the Client IDfield.
4. Specify the client secret that must be shared between the client application and the identity provider in the Client Secretfield.
5. Specify the URI where authorization requests are made to your identity provider in the Issuer URLfield.
6. Click Nextto set the OIDC attributes.

Azure AD

1. Select New Azure Active Directoryto create a new Azure AD configuration.
2. Specify the name you want to use to identify this configuration in the Provider namefield, typically the identity provider name. This name must start with a letter followed by up to 39 lowercase letters, numbers, or hyphens, and cannot end with a hyphen. You cannot edit this name once you've created a configuration.
3. Specify the client ID returned when registering GKE Identity Service with your provider in the Client IDfield.
4. Specify the client secret that must be shared between the client application and the identity provider in the Client Secretfield.
5. Specify the tenant that is the Azure AD account to be authenticated in the Tenant.
6. Click Nextto set the Azure AD attributes.

LDAP

1. Select LDAPto create a new LDAP configuration.
2. Specify the name you want to use to identify this configuration in the Provider namefield, typically the identity provider name. This name must start with a letter followed by up to 39 lowercase letters, numbers, or hyphens, and cannot end with a hyphen. You cannot edit this name once you've created a configuration.
3. Click Next.
4. Specify the hostname (mandatory), LDAP connection type, and base64-encoded CA certificate of the LDAP server.
5. Click Nextto configure the server.
6. Specify the user's distinguished name, filter, login attribute, and identifier attribute.
7. Click Nextto set the user details.
8. If you choose to use groups, specify the group's distinguished name, filter, and identifier attribute.
9. Click Nextto set the group details.
10. Specify the service account username and password.
11. Click Doneto set the service account name.

OIDC

• Fill in the configuration attributes:

  • kubectl redirect URI: The redirect URL and port used by the gcloud CLI and specified by your platform administrator at registration, typically in the form http: // localhost:PORT/callback .
  • Certificate Authority(Optional): If provided by your platform administrator, a PEM-encoded certificate string for the identity provider.
  • Group Claim(Optional): The JWT claim (field name) that your provider uses to return an account's security groups.
  • Group Prefix(Optional): The prefix you want to prepend to security group names to avoid clashes with existing names in your access control rules if you have configurations for multiple identity providers (typically the provider name).
  • Proxy(Optional): Proxy server address to use to connect to the identity provider, if applicable. You might need to set this if, for example, your cluster is in a private network and needs to connect to a public identity provider. For example: http://user:password@10.10.10.10:8888 .
  • Scopes(Optional): Any additional scopes required by your identity provider. Microsoft Azure and Okta require the offline_access scope. Click Add scopeto add more scopes if necessary.
  • User Claim(Optional): The JWT claim (field name) that your provider uses to identify an account. If you don't specify a value here, GKE Identity Service uses "sub", which is the user ID claim used by many providers. You can choose other claims, such as "email" or "name", depending on the OpenID provider. Claims other than "email" are prefixed with the issuer URL to prevent naming clashes.
  • User Prefix(Optional): The prefix you want prepended to user claims to prevent clashes with existing names, if you don't want to use the default prefix.
  • Extra Params(Optional): Any extra parameters required for your configuration, specified as the parameter Keyand Value. Click Add paramto add more parameters if needed.
  • Enable access token(Optional): If enabled, it allows group support for OIDC providers such as Okta.
  • Deploy Google Cloud console proxy(Optional): If enabled, a proxy is deployed that lets the Google Cloud console connect to an on-premises identity provider that is not publicly accessible over the internet.

Azure AD

• Fill in the configuration attributes:

  • kubectl redirect URI: The redirect URL and port used by the gcloud CLI and specified by your platform administrator at registration, typically in the form http: // localhost:PORT/callback .
  • User Claim(Optional): The JWT claim (field name) that your provider uses to identify an account. If you don't specify a value here, GKE Identity Service uses a value in the order of "email", "preferred_username", or "sub" to fetch the user details.
  • Proxy(Optional): Proxy server address to use to connect to the identity provider, if applicable. You might need to set this if, for example, your cluster is in a private network and needs to connect to a public identity provider. For example: http://user:password@10.10.10.10:8888 .

OIDC

The following file shows both an oidc configuration and an azuread configuration. For more information on when to use oidc or azuread , see Provider-specific configurations .

   
 apiVersion 
 : 
  
 authentication.gke.io/v2alpha1 
  
 kind 
 : 
  
 ClientConfig 
  
 metadata 
 : 
  
 name 
 : 
  
 default 
  
 namespace 
 : 
  
 kube-public 
  
 spec 
 : 
  
 authentication 
 : 
  
 - 
  
 name 
 : 
  
  NAME 
 
  
 proxy 
 : 
  
  PROXY_URL 
 
  
 oidc 
 : 
  
 certificateAuthorityData 
 : 
  
  CERTIFICATE_STRING 
 
  
 clientID 
 : 
  
  CLIENT_ID 
 
  
 clientSecret 
 : 
  
  CLIENT_SECRET 
 
  
 deployCloudConsoleProxy 
 : 
  
  PROXY_BOOLEAN 
 
  
 extraParams 
 : 
  
  EXTRA_PARAMS 
 
  
 groupsClaim 
 : 
  
  GROUPS_CLAIM 
 
  
 groupPrefix 
 : 
  
  GROUP_PREFIX 
 
  
 issuerURI 
 : 
  
  ISSUER_URI 
 
  
 kubectlRedirectURI 
 : 
  
 http://localhost: PORT 
/callback 
  
 scopes 
 : 
  
  SCOPES 
 
  
 userClaim 
 : 
  
  USER_CLAIM 
 
  
 userPrefix 
 : 
  
  USER_PREFIX 
 
  
 - 
  
 name 
 : 
  
  NAME 
 
  
 proxy 
 : 
  
  PROXY_URL 
 
  
 azureAD 
 : 
  
 clientID 
 : 
  
  CLIENT_ID 
 
  
 clientSecret 
 : 
  
  CLIENT_SECRET 
 
  
 tenant 
 : 
  
  TENANT_UUID 
 
  
 kubectlRedirectURI 
 : 
  
 http://localhost: PORT 
/callback 
 

If you have configured more than one identity provider, you can list multiple authentication configurations in the auth-config.yaml file under the authentication anchor in the same format as in the preceding configuration. The following table describes the fields of the ClientConfig oidc and azuread object. Most of the fields are optional. The fields you need to add depend on your identity provider and the setup options chosen by your platform administrator when configuring the provider for GKE Identity Service .

SAML

The following file shows a SAML configuration:

   
 apiVersion 
 : 
  
 authentication.gke.io/v2alpha1 
  
 kind 
 : 
  
 ClientConfig 
  
 metadata 
 : 
  
 name 
 : 
  
 default 
  
 namespace 
 : 
  
 kube-public 
  
 spec 
 : 
  
 authentication 
 : 
  
 - 
  
 name 
 : 
  
  NAME 
 
  
 saml 
 : 
  
 idpEntityID 
 : 
  
  ENTITY_ID 
 
  
 idpSingleSignOnURI 
 : 
  
  SIGN_ON_URI 
 
  
 idpCertificateDataList 
 : 
  
  IDP_CA_CERT 
 
  
 userAttribute 
 : 
  
  USER_ATTRIBUTE 
 
  
 groupsAttribute 
 : 
  
  GROUPS_ATTRIBUTE 
 
  
 userPrefix 
 : 
  
  USER_PREFIX 
 
  
 groupPrefix 
 : 
  
  GROUP_PREFIX 
 
  
 attributeMapping 
 : 
  
 ATTRIBUTE_KEY_1 
 : 
  
  ATTRIBUTE_CEL_EXPRESSION_1 
 
  
 ATTRIBUTE_KEY_2 
 : 
  
  ATTRIBUTE_CEL_EXPRESSION_2 
 
  
  
 certificateAuthorityData 
 : 
  
  CERTIFICATE_STRING 
 
  
 preferredAuthentication 
 : 
  
  PREFERRED_AUTHENTICATION 
 
  
 server 
 : 
  
<> 

The following table describes the fields of the ClientConfig saml object. The fields you need to add depend on your identity provider and the setup options chosen by your platform administrator when configuring the provider for GKE Identity Service .

LDAP

The following file shows an ldap configuration.

   
 apiVersion 
 : 
  
 authentication.gke.io/v2alpha1 
  
 kind 
 : 
  
 ClientConfig 
  
 metadata 
 : 
  
 name 
 : 
  
 default 
  
 namespace 
 : 
  
 kube-public 
  
 spec 
 : 
  
 authentication 
 : 
  
 - 
  
 name 
 : 
  
 ldap 
  
 ldap 
 : 
  
 server 
 : 
  
 host 
 : 
  
  HOST_NAME 
 
  
 connectionType 
 : 
  
  CONNECTION_TYPE 
 
  
 certificateAuthorityData 
 : 
  
  CERTIFICATE_AUTHORITY_DATA 
 
  
 user 
 : 
  
 baseDn 
 : 
  
  BASE_DN 
 
  
 loginAttribute 
 : 
  
  LOGIN_ATTRIBUTE 
 
  
 filter 
 : 
  
  FILTER 
 
  
 identifierAttribute 
 : 
  
  IDENTIFIER_ATTRIBUTE 
 
  
 group 
 : 
  
 baseDn 
 : 
  
  BASE_DN 
 
  
 filter 
 : 
  
  FILTER 
 
  
 identifierAttribute 
 : 
  
  IDENTIFIER_ATTRIBUTE 
 
  
 serviceAccount 
 : 
  
 simpleBindCredentials 
 : 
  
 dn 
 : 
  
  DISTINGUISHED_NAME 
 
  
 password 
 : 
  
  PASSWORD 
 
 

The following table describes the fields in the ClientConfig ldap object. The fields you need to add depend on your identity provider and the setup options chosen by your platform administrator when configuring the provider for GKE Identity Service :