Manage Kubernetes Rbac Users With Google Groups For Gke

More Info:

Cluster Administrators Should Leverage G Suite Groups And Cloud Iam To Assign Kubernetes User Roles To A Collection Of Users, Instead Of To Individual Emails Using Only Cloud Iam.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CIS GKE
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Manual Steps

Identify and review current cluster Google Groups for GKE configuration

On any machine with gcloud access, run:

gcloud container clusters describe CLUSTER_NAME \
  --location CONTROL_PLANE_LOCATION \
  --project PROJECT_ID \
  --format json | jq '{Enabled: .authenticatorGroupsConfig.enabled, "Security Group": .authenticatorGroupsConfig.securityGroup}'

If Enabled is false or Security Group is null, the cluster is not using Google Groups for GKE.

Confirm existence and ownership of the intended security group
- In Google Admin Console (admin.google.com) under Directory → Groups, verify that the group you plan to use (for example, gke-security-groups@YOUR_DOMAIN) exists, is owned by admins, and membership is managed according to your org’s access policies.
- Decide which G Suite group will be used as the “security group” root for Google Groups for GKE.
Decide whether to enable or adjust Google Groups for GKE on the cluster
- If the command in step 1 shows a different securityGroup than the one you intend to standardize on, or it is unset, plan the change:
  - Choose the primary security group email (for example, gke-security-groups@YOUR_DOMAIN).
  - Ensure all teams understand that Kubernetes access will be granted via membership in sub‑groups of this security group.
Configure or update the cluster to use Google Groups for GKE
- On any machine with gcloud access, for an existing cluster:
```
gcloud container clusters update CLUSTER_NAME \
  --location CONTROL_PLANE_LOCATION \
  --project PROJECT_ID \
  --security-group="gke-security-groups@YOUR_DOMAIN"
```
- For clusters created via IaC (Terraform, Deployment Manager), update the cluster resource to set the equivalent security_group / authenticatorGroupsConfig.securityGroup field, then apply via your normal IaC workflow.
Review Kubernetes RBAC bindings to ensure they reference groups, not individual users
- On any machine with kubectl access:
```
kubectl get clusterrolebindings.rbac.authorization.k8s.io -o yaml
kubectl get rolebindings.rbac.authorization.k8s.io --all-namespaces -o yaml
```
- Inspect subjects sections and confirm that:
  - kind: Group subjects reference G Suite groups (e.g. dev-team@YOUR_DOMAIN) that are members of the security group.
  - Direct kind: User subjects using individual email identities are minimized or removed where feasible.
Verify configuration after changes
- Re-run the audit command from step 1 to confirm Enabled is true and Security Group matches the intended group:
```
gcloud container clusters describe CLUSTER_NAME \
  --location CONTROL_PLANE_LOCATION \
  --project PROJECT_ID \
  --format json | jq '{Enabled: .authenticatorGroupsConfig.enabled, "Security Group": .authenticatorGroupsConfig.securityGroup}'
```
- Optionally, test with a user who is only a member of the relevant G Suite group (and not directly bound as a user) to confirm Kubernetes access is granted via group-based RBAC.

Using kubectl

kubectl cannot configure Google Groups for GKE or the cluster’s authenticatorGroupsConfig; this must be set on the managed control plane via gcloud, the GCP console, or IaC. See the Manual Steps section for how to enable a security group on the cluster and then bind those groups with RBAC.

Automation

#!/usr/bin/env bash
#
# Report GKE Google Groups for GKE (RBAC via security-group) configuration
# across multiple clusters/projects/locations.
#
# REQUIREMENTS:
#   - gcloud installed and authenticated
#   - jq installed
#
# USAGE EXAMPLES:
#   # Single project, all locations, all clusters
#   ./check_gke_google_groups.sh my-project-id
#
#   # Multiple projects
#   ./check_gke_google_groups.sh proj-a proj-b proj-c
#
#   # Environment variables can scope listing further if desired, e.g.:
#   #   CLOUDSDK_COMPUTE_REGION / CLOUDSDK_COMPUTE_ZONE

set -euo pipefail

if ! command -v gcloud >/dev/null 2>&1; then
  echo "ERROR: gcloud not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

if [ "$#" -lt 1 ]; then
  echo "Usage: $0 PROJECT_ID [PROJECT_ID ...]" >&2
  exit 1
fi

echo "Checking Google Groups for GKE configuration across clusters..."
echo

for PROJECT in "$@"; do
  echo "================================================================"
  echo "PROJECT: ${PROJECT}"
  echo "================================================================"

  # List all clusters in the project in all regions/zones
  # (requires appropriate IAM permissions).
  CLUSTERS_JSON=$(gcloud container clusters list \
    --project "${PROJECT}" \
    --format json 2>/dev/null || echo "[]")

  if [ "$(echo "${CLUSTERS_JSON}" | jq 'length')" -eq 0 ]; then
    echo "No clusters found in project ${PROJECT}"
    echo
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -r '.[] | @base64' | while read -r CLUSTER_B64; do
    _jq() { echo "${CLUSTER_B64}" | base64 --decode | jq -r "${1}"; }

    NAME=$(_jq '.name')
    LOCATION=$(_jq '.location')

    echo "Cluster: ${NAME}"
    echo "  Location: ${LOCATION}"

    # Describe cluster to get authenticatorGroupsConfig
    DESC_JSON=$(gcloud container clusters describe "${NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT}" \
      --format json 2>/dev/null || echo "{}")

    ENABLED=$(echo "${DESC_JSON}" | jq -r '.authenticatorGroupsConfig.enabled // "false"')
    SECURITY_GROUP=$(echo "${DESC_JSON}" | jq -r '.authenticatorGroupsConfig.securityGroup // ""')

    echo "  Google Groups for GKE enabled: ${ENABLED}"
    echo "  Security group: ${SECURITY_GROUP}"

    # Basic evaluation of state
    if [ "${ENABLED}" != "true" ] || [ -z "${SECURITY_GROUP}" ] || [ "${SECURITY_GROUP}" = "null" ]; then
      echo "  STATUS: PROBLEM - Google Groups for GKE not correctly configured."
      echo "          - Expected: authenticatorGroupsConfig.enabled=true"
      echo "          - Expected: authenticatorGroupsConfig.securityGroup set to a G Suite group (e.g. gke-security-groups@DOMAIN)"
    else
      echo "  STATUS: OK - Google Groups for GKE configured."
    fi

    echo
  done
done

How to run (any machine with gcloud access):

Save as check_gke_google_groups.sh.
chmod +x check_gke_google_groups.sh

Run, e.g.:

./check_gke_google_groups.sh my-project-1 my-project-2

Output interpretation (what indicates a problem):

Google Groups for GKE enabled: false
or
Security group: (empty or null)
or
Line: STATUS: PROBLEM - Google Groups for GKE not correctly configured.

These clusters are not leveraging G Suite Groups via the --security-group configuration and require manual review and potential reconfiguration following the benchmark remediation.

Additional Reading:

https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#google-groups-for-gke

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​