<p>I am interacting with a GKE cluster and trying to understand what are my permissions</p>

<pre><code>➢  kubectl get roles --all-namespaces
NAMESPACE      NAME                                             AGE
istio-system   istio-ingressgateway-sds                         38d
kube-public    system:controller:bootstrap-signer               38d
kube-system    cloud-provider                                   38d
kube-system    extension-apiserver-authentication-reader        38d
kube-system    gce:cloud-provider                               38d
kube-system    sealed-secrets-key-admin                         38d
kube-system    system::leader-locking-kube-controller-manager   38d
kube-system    system::leader-locking-kube-scheduler            38d
kube-system    system:controller:bootstrap-signer               38d
kube-system    system:controller:cloud-provider                 38d
kube-system    system:controller:token-cleaner                  38d
kube-system    system:fluentd-gcp-scaler                        38d
kube-system    system:pod-nanny                                 38d
</code></pre>

<p>However I do not see any role associated with me.</p>

<p>How am I interacting with the <code>k8s</code> cluster?</p>

<p>How can I see whoami and what are my permissions?</p>

pkaramol
<p>The command and output you are sharing refers to Kubernetes RBAC Authorization (not exclusive of GKE). You can find the definition for each role <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#discovery-roles" rel="nofollow noreferrer">HERE</a></p>

<p>If you want to be specific to GKE you can use both Cloud Identity and Access Management and Kubernetes RBAC to control access to your GKE cluster.</p>

<p>Cloud IAM is not specific to Kubernetes; it provides identity management for multiple Google Cloud Platform products, and operates primarily at the level of the GCP project.</p>

<p>Kubernetes RBAC is a core component of Kubernetes and allows you to create and grant roles (sets of permissions) for any object or type of object within the cluster. You can find more information on how RBAC integrates with GKE <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control" rel="nofollow noreferrer">HERE</a></p>

<p>You don’t see any roles associated to you because are querying the roles for all the namespaces and most likely you haven’t define a single one.</p>

<p>You are interacting with your cluster from the cloud shell. Before connecting to your cluster you must had run the following command.</p>

<pre><code>gcloud container clusters get-credentials CLUSTER_NAME --zone ZONE --project PROJECT_ID
</code></pre>

<p>You authenticate to the cluster using the same user you authenticate with to login to GCP. More information on authentication for kubectl <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl#authentication" rel="nofollow noreferrer">HERE</a></p>

<p>You can get role binding and cluster roles based on namespace or resource as seen in my example commands.</p>

<pre><code>kubectl get rolebinding POD_NAME -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"pod-reader-binding","namespace":"default"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"Role","name":"pod-reader"},"subjects":[{"kind":"User","name":"example@foo.com"},{"kind":"ServiceAccount","name":"johndoe"},{"kind":"User","name":"test-account@example.google.com.iam.gserviceaccount.com"},{"kind":"Group","name":"accounting-group@example.com"}]}
  creationTimestamp: xxxx-xx-xxxx:xx:xxZ
  name: pod-reader-binding
  namespace: default
  resourceVersion: "1502640"
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/default/rolebindings/pod-reader-binding
  uid: de1775dc-cd85-11e9-a07d-42010aa800c2
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: example@foo.com
</code></pre>

<p>In the above examle my user [example@foo.com] is a member of APIGroup [rbac.authorization.k8s.io] so his actions on the pod will be limited by the permission he is giving with RBAC for example if you want to give this user readd access you need to specify the the following line in thr YAML</p>

<pre><code>verbs: ["get", "watch", "list"]
</code></pre>

<p>Finally there are many Predefined GKE Roles that grants different permissions to GCP user or service accounts. You can find each role and permissions <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/iam#predefined" rel="nofollow noreferrer">HERE</a></p>
