I'm administering a k8s cluster (on Google Kubernetes Engine if it matters) and would like to apply a fairly fine-grained RBAC role to all of our users that aren't service accounts.

From reading documentation, I gather that groups are a bit of a made-up construct in the sense that each user just has a list of strings attached to it specifying which groups it belongs to.

However, I can't figure out where this is actually kept track of. There's no such thing as kubectl get groups. It seems like k8s by design outsources the management of all this stuff to whatever system is doing the authentication/authorization, but I can't find how Google IAM is handling it either. Am I misunderstanding the whole thing?


Since May 2019, it is possible to use Google Groups membership in RBAC on GKE clusters within G Suite. Please see the link for more details.

Disclosure: I was a member of the Google team that implemented the feature.


The RBAC feature is not available on GKE for Google groups. You will have to use Cloud IAM in order to assign permissions to groups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.