I'm administering a k8s cluster (on Google Kubernetes Engine if it matters) and would like to apply a fairly fine-grained RBAC role to all of our users that aren't service accounts.
From reading documentation, I gather that groups are a bit of a made-up construct in the sense that each user just has a list of strings attached to it specifying which groups it belongs to.
However, I can't figure out where this is actually kept track of. There's no such thing as kubectl get groups
. It seems like k8s by design outsources the management of all this stuff to whatever system is doing the authentication/authorization, but I can't find how Google IAM is handling it either. Am I misunderstanding the whole thing?