I'm picking on my Google Cloud instances are created as new system users. The format is: /home/gke-xxxxxxxxxx
These users appear in instances of Linux based on Debian and Google Container Engine.
For example:
root@node1:/home# ls -lh
total 24K
drwxr-xr-x 3 gke-34cf46593ebc10a5beb5 gke-34cf46593ebc10a5beb5 4.0K Sep 29 04:18 gke-34cf46593ebc10a5beb5
drwxr-xr-x 3 gke-b230f34ceeb7c905fdb6 gke-b230f34ceeb7c905fdb6 4.0K Sep 29 04:18 gke-b230f34ceeb7c905fdb6
root@node1:/etc# cat /etc/passwd | grep gke
gke-34cf46593ebc10a5beb5:x:1021:1022::/home/gke-34cf46593ebc10a5beb5:/bin/bash
gke-b230f34ceeb7c905fdb6:x:1022:1023::/home/gke-b230f34ceeb7c905fdb6:/bin/bash
root@node1:/etc# cat /etc/group | grep gke
adm:x:4:gke-34cf46593ebc10a5beb5,gke-b230f34ceeb7c905fdb6
dip:x:30:gke-34cf46593ebc10a5beb5,gke-b230f34ceeb7c905fdb6
video:x:44:gke-34cf46593ebc10a5beb5,gke-b230f34ceeb7c905fdb6
plugdev:x:46:gke-34cf46593ebc10a5beb5,gke-b230f34ceeb7c905fdb6
google-sudoers:x:1000:gke-34cf46593ebc10a5beb5,gke-b230f34ceeb7c905fdb6
gke-34cf46593ebc10a5beb5:x:1022:
gke-b230f34ceeb7c905fdb6:x:1023:This is a piece of log in: /var/log/auth.log
Sep 29 04:18:57 node1 useradd[11226]: new group: name=gke-34cf46593ebc10a5beb5, GID=1022
Sep 29 04:18:57 node1 useradd[11226]: new user: name=gke-34cf46593ebc10a5beb5, UID=1021, GID=1022, home=/home/gke-34cf46593ebc10a5beb5, shell=/bin/bash
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to group 'adm'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to group 'dip'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to group 'video'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to group 'plugdev'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to group 'google-sudoers'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to shadow group 'adm'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to shadow group 'dip'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to shadow group 'video'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to shadow group 'plugdev'
Sep 29 04:18:57 node1 usermod[11231]: add 'gke-34cf46593ebc10a5beb5' to shadow group 'google-sudoers'
Sep 29 04:18:57 node1 useradd[11236]: new group: name=gke-b230f34ceeb7c905fdb6, GID=1023
Sep 29 04:18:57 node1 useradd[11236]: new user: name=gke-b230f34ceeb7c905fdb6, UID=1022, GID=1023, home=/home/gke-b230f34ceeb7c905fdb6, shell=/bin/bash
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to group 'adm'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to group 'dip'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to group 'video'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to group 'plugdev'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to group 'google-sudoers'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to shadow group 'adm'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to shadow group 'dip'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to shadow group 'video'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to shadow group 'plugdev'
Sep 29 04:18:57 node1 usermod[11241]: add 'gke-b230f34ceeb7c905fdb6' to shadow group 'google-sudoers'I suspect that this is some internal thing from Google Cloud. The firewall not allow SSH connections outside my authorized IPs. What is the reason why these users appear?
Thanks for all.
When a GKE cluster is created in your project, it also adds an SSH key associated to it in the project metadata. These SSH keys can be displayed by going to your Google Cloud Console -> Compute Engine -> Metadata -> SSH keys.
Project-Wide SSH keys, like the ones created during the deployment of GKE clusters, are transferred to all the instances in your project unless the instance is defined to work with specific keys. These keys are copied in the home directory of each VM for each user (/home/user/.ssh). When you delete a GKE deployment, the SSH key is removed from the metadata. Keys that are removed from the metadata are also deleted from /home/user/.ssh/authorized_keys. Neverhteless the home directory for users is not deleted on the VMs.