I'm administering a k8s cluster (on Google Kubernetes Engine if it matters) and would like to apply a fairly fine-grained RBAC role to all of our users that aren't service accounts.
From reading documentation, I gather that groups are a bit of a made-up construct in the sense that each user just has a list of strings attached to it specifying which groups it belongs to.
However, I can't figure out where this is actually kept track of. There's no such thing as
kubectl get groups. It seems like k8s by design outsources the management of all this stuff to whatever system is doing the authentication/authorization, but I can't find how Google IAM is handling it either. Am I misunderstanding the whole thing?