Manage Kubernetes Rbac Users With Google Groups For Gke

#!/usr/bin/env bash
#
# Report GKE Google Groups for GKE (RBAC via security-group) configuration
# across multiple clusters/projects/locations.
#
# REQUIREMENTS:
#   - gcloud installed and authenticated
#   - jq installed
#
# USAGE EXAMPLES:
#   # Single project, all locations, all clusters
#   ./check_gke_google_groups.sh my-project-id
#
#   # Multiple projects
#   ./check_gke_google_groups.sh proj-a proj-b proj-c
#
#   # Environment variables can scope listing further if desired, e.g.:
#   #   CLOUDSDK_COMPUTE_REGION / CLOUDSDK_COMPUTE_ZONE

set -euo pipefail

if ! command -v gcloud >/dev/null 2>&1; then
  echo "ERROR: gcloud not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

if [ "$#" -lt 1 ]; then
  echo "Usage: $0 PROJECT_ID [PROJECT_ID ...]" >&2
  exit 1
fi

echo "Checking Google Groups for GKE configuration across clusters..."
echo

for PROJECT in "$@"; do
  echo "================================================================"
  echo "PROJECT: ${PROJECT}"
  echo "================================================================"

  # List all clusters in the project in all regions/zones
  # (requires appropriate IAM permissions).
  CLUSTERS_JSON=$(gcloud container clusters list \
    --project "${PROJECT}" \
    --format json 2>/dev/null || echo "[]")

  if [ "$(echo "${CLUSTERS_JSON}" | jq 'length')" -eq 0 ]; then
    echo "No clusters found in project ${PROJECT}"
    echo
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -r '.[] | @base64' | while read -r CLUSTER_B64; do
    _jq() { echo "${CLUSTER_B64}" | base64 --decode | jq -r "${1}"; }

    NAME=$(_jq '.name')
    LOCATION=$(_jq '.location')

    echo "Cluster: ${NAME}"
    echo "  Location: ${LOCATION}"

    # Describe cluster to get authenticatorGroupsConfig
    DESC_JSON=$(gcloud container clusters describe "${NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT}" \
      --format json 2>/dev/null || echo "{}")

    ENABLED=$(echo "${DESC_JSON}" | jq -r '.authenticatorGroupsConfig.enabled // "false"')
    SECURITY_GROUP=$(echo "${DESC_JSON}" | jq -r '.authenticatorGroupsConfig.securityGroup // ""')

    echo "  Google Groups for GKE enabled: ${ENABLED}"
    echo "  Security group: ${SECURITY_GROUP}"

    # Basic evaluation of state
    if [ "${ENABLED}" != "true" ] || [ -z "${SECURITY_GROUP}" ] || [ "${SECURITY_GROUP}" = "null" ]; then
      echo "  STATUS: PROBLEM - Google Groups for GKE not correctly configured."
      echo "          - Expected: authenticatorGroupsConfig.enabled=true"
      echo "          - Expected: authenticatorGroupsConfig.securityGroup set to a G Suite group (e.g. gke-security-groups@DOMAIN)"
    else
      echo "  STATUS: OK - Google Groups for GKE configured."
    fi

    echo
  done
done