<p>I am using GKE Kubernetes in GCP. I am new to GCP, GKE, and kubectl. I am trying to create new Kubernetes users in order to assign them ClusterRoleBindings, and then login (kubectl) as those users.</p>

<p>I do not see the relationship between GCP users and Kubernetes "users" (I do understand there's no User object type in Kubernetes).</p>

<p>According to <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/security-overview" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/security-overview</a> , Kubernetes user accounts are Google Accounts.</p>

<p>Accordingly, I created some Google accounts and then associated them with my GCP account via IAM. I can see these accounts fine in IAM.</p>

<p>Then I performed gcloud auth login on those new users, and I could see them in gcloud auth list. I then tried accessing gcloud resources (gcloud compute disks list) as my various users. This worked as expected - the GCP user permissions were respected.</p>

<p>I then created a Kubernetes UserRole. Next step was to bind those users to those Roles, with a UserRoleBinding.</p>

<p>ClusterRole.yaml (creates fine):</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: cluster-role-pod-reader-1
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>ClusterRoleBinding.yaml (creates fine):</p>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cluster-role-binding-pod-reader-1
subjects:
- kind: User
  name: MYTESTUSER@gmail.com  # not real userid
  apiGroup: rbac.authorization.k8s.io
roleRef: 
  kind: ClusterRole
  name: cluster-role-pod-reader-1
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>In Kubernetes, I could create bindings, but my first problem is that I could create a UserRoleBinding between an existing UserRole and a <em>non</em>-existent user. I would have thought that would fail. It means I'm missing something important.</p>

<p>My second problem is I do not know how to login to kubectl as one of the new users.</p>

<p>Overall I'm missing the connection between GCP/IAM users and GKE users. Help would be much appreciated!</p>

Marc Riehm
<p>Kubernetes doesn't have a user database. Users live outside the cluster and are usually controlled by the cloud provider. </p>

<p>If you're using GKE, the users are controlled by the GCP IAM. Therefore you can't list users with <code>kubectl</code>.</p>

<p>You can create <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#user-accounts-vs-service-accounts" rel="noreferrer">service accounts</a> though. However, it is important to understand the difference between service accounts and users. Users are for real people while service accounts are for processes inside and outside kubernetes.</p>

<p>When you create a ClusterRoleBinding this means to kubernetes:  </p>

<p><em>If a user with the username <strong>MYTESTUSER@gmail.com</strong> enters the cluster, bind him to the ClusterRole <strong>cluster-role-pod-reader-1</strong></em></p>

<p>To use kubernetes with the GCP IAM users, you have to do the following: </p>

<ul>
<li>add the user to IAM</li>
<li>add him to the role <code>roles/container.viewer</code></li>
<li>create the RoleBinding/ClusterRoleBinding of your choice</li>
</ul>

<p>You can list the respective IAM roles (not to be mistaken with RBAC roles) with this command:</p>

<pre><code>gcloud iam roles list | grep 'roles/container\.' -B2 -A2
</code></pre>

<p>With the principle of least privilige in mind you should grant your user only the minimal rights to login into the cluster. The other IAM roles (except for <code>roles/container.clusterAdmin</code>) will automatically grant access with higher privileges to objects inside the <strong>all</strong> clusters of your project.</p>

<p>RBAC allows just the addition of privileges therefore you should choose the IAM role with the least privileges and add the required privileges via RBAC on top.</p>
