PRIYANKA VERGADIA: Do you find it
challenging to maintain identities
across different environments and hybrid and multi-cloud
deployments?
Do you wish you can leverage your existing identity
investments for Anthos?
Well, keep watching as we cover how
you can use Anthos to simplify identity management for users
and workloads.
[MUSIC PLAYING]
Hi.
I'm Priyanka Vergadia, and welcome to "Anthos 101."
With Anthos, our goal is to make it seamless
for you to modernize and manage your workloads
in an environment that you prefer,
whether it is on-prem, Google Cloud, Edge,
or a different cloud.
Anthos spans across multiple environments,
and each is built on different identity store, for example,
Active Directory for on-prem, Cloud Identity for Google
Cloud, and AWS IAM for AWS.
In addition to employee identity,
you may need to manage partner, [INAUDIBLE] identity, workload
identity, or customer identity, further increasing
the complexity.
Traditionally, Google Cloud has offered
a synchronization-based identity model,
requiring you to synchronize identities with Google Cloud.
While this may work for certain scenarios,
you may have concerns around consistency and latency
for a hybrid or multi-cloud deployment.
With Anthos, we want to meet you where you are.
Anthos Identity Service extends existing capabilities
and it enables you to use third-party identity providers
and authentication protocols, following a federation model.
This service can be deployed quickly in your Anthos GKE
cluster, enabling protocols such as OpenID Connect.
You no longer need to synchronize identities
to Google Cloud or worry about consistency
across environments.
It saves time and reduces friction
during the onboarding process.
Anthos on-prem offers OIDC support,
which enables authentication via G Cloud
or through Cloud Console.
Let's walk through how that experience looks like.
Say you are a platform administrator managing
a small team of developers, and you're
interested in providing access to the Kubernetes API server
to debug issues or perform cluster management tasks
using Kubectl.
After creating a user cluster for GKE on-prem,
you can run a gkectl command to generate a login configuration
file.
You will need to populate this file with values
specific to your identity provider,
such as issuer URL, redirect URL, and client ID.
You can enable one or multiple identity providers to support
needs of different user groups.
The file can be securely distributed to developers
using an accessible URL.
In order to restrict access based on privileges granted
to authenticated users, you can use
Kubernetes role-based access control
to create cluster roles that grant specific privileges
to users and groups.
As a developer, you can install the G Cloud SDK
without requiring a Google Cloud Identity account
and install the Anthos autho components
to enable third-party OIDC authentication.
Simply run gcloud anthos auth login,
to view the list of available clusters
and specify a cluster flag to log in.
Based on your Kubernetes RBAC privileges,
you can now run Kubectl commands to complete
your required tasks.
Moving forward, we are planning to enable additional protocols,
such as LDAP, to support authentication needs
for multiple environments, including Google Cloud,
on-prem, and other clouds.
We're also extending our OIDC capabilities to other clouds
to create a consistent multi-cloud experience.
Anthos Identity Service is designed to work seamlessly
with other Anthos components and your existing identity
investments.
Beyond user authentication, you can also
enable workload authentication for workloads
running in GKE to consume services
provided by Google APIs.
Simply configure a Kubernetes service account
to automatically authenticate when
accessing Google Cloud APIs.
There's no need to worry about safeguarding
private keys for PKI and client certificates or managing bearer
and bootstrap tokens.
Anthos Identity Service provides a fully integrated,
enterprise-ready solution for authentication that
is built with security in mind.
As you can see, Anthos Identity Service
offers a seamless solution for managing authentication
to multiple Anthos GKE environments,
allowing you to leverage existing identity investments
and streamline the onboarding process.
To learn more about Anthos Identity
Service and our identity features, check out
the documentation below.
And for more Anthos content, don't
forget to subscribe and follow the "Anthos 101" playlist.
[MUSIC PLAYING]