Least privilege IAM setup for managing a GKE private cluster using a bastion host

Question

I would like to create a bastion host to manage a private GKE cluster on GCP.

• The bastion host is a GCE VM named bastion.
• The cluster is a GKE private cluster named cluster.

The flow should be:

User -> (SSH via IAP) -> bastion -> (gke control-plane) -> cluster

For both resources, I would like to create and configure two service accounts from scratch in order to ensure the principle of the least privilege.

Do you have any suggestions for the optimal setup for scopes and roles?

Answer 1

To have a better overview about how to handle GKE clusters for production purposes, I would suggest taking a look on this article, specifically on the section dedicated for Private Clusters in which is mentioned the alternative to use VPC Service Controls that can help you mitigate the risk of data exfiltration.