<p><strong>Context</strong></p>
<p>Access to a Google Cloud (GKE) kubernetes cluster is managed through the Google Cloud IAM feature;</p>
<ol>
<li><p>An admin invites a new user (using their google account/login) and assigns them a role.</p>
<p>The example role below is &quot;Container Engine Viewer&quot;, which will allow the user to access the kubernetes cluster and run all &quot;view&quot; operations.</p>
</li>
<li><p>The User can use the <code>gcloud auth login</code> on their local machine followed by <code>gcloud container clusters get-credentials</code> to authenticate to Google IAM and have the <code>gcloud</code> tool write them out a kubernetes config file, ready to use the cluster.</p>
</li>
<li><p>Users can then use <code>kubectl</code> to access the cluster. With the example above, reads work... writes/changes dont; all good!</p>
</li>
</ol>
<p><strong>The Problem</strong></p>
<p>The IAM roles for a GKE kubernetes cluster are very simple, &quot;Admin, Read/Write, Read&quot;.</p>
<p>For more fine-grained control over the kubernetes cluster, Kubernetes RBAC
should be used <em>within</em> the cluster, allowing me to restrict a user to a single namespace, single API endpoint, single action, etc.</p>
<p>However, without specifying an IAM role for the user; the user has no way of authenticating to the cluster (RBAC is authorization, not authentication).</p>
<p>Yet, the <em>Lowest</em> permission IAM role I can set is &quot;Container Engine Viewer&quot;, so regardless of the restrictions I implement with Kubernetes RBAC, All my users still have full read access.</p>
<p><strong>Question</strong></p>
<p>Has anyone found a way to ensure all permissions in GKE are coming from RBAC, basically nullifying the permissions from IAM?</p>

<p>Weird how writing out the problem gets you to an answer sooner huh?</p>
<p>Theres a new &quot;Alpha&quot; feature in Google Cloud's IAM which wasn't there last time I tried to tackle this problem;</p>
<p>Under IAM &gt; Roles, you can now create custom IAM roles with your own subset of permissions.</p>
<p>I created a minimal role which allows <code>gcloud container clusters get-credentials</code> to work, but nothing else, allowing permissions within the kubernetes cluster to be fully managed by RBAC.</p>
<p>Initial testing looks good.</p>
<p>IAM Role Screenshots (with the permissions needed) below.</p>
<p><a href="https://i.stack.imgur.com/YaUKc.png" rel="noreferrer">Minimal IAM role with GKE cluster access</a></p>
<p><a href="https://i.stack.imgur.com/rzjsF.png" rel="noreferrer">New IAM roles alpha functionality</a></p>
