We are enabling Google Cloud Groups RBAC in our existing GKE clusters.

For that, we first created all the groups in Workspace, and also the required "gke-security-groups@ourdomain.com" according to documentation.

Those groups are created in Workspace with an integration with Active Directory for Single Sign On.

All groups are members of "gke-security-groups@ourdomain" as stated by documentation. And all groups can View members.

The cluster was updated to enabled the flag for Google Cloud Groups RBAC and we specify the value to be "gke-security-groups@ourdomain.com".

We then Added one of the groups (let's called it group_a@ourdomain.com) to IAM and assigned a custom role which only gives access to:

"container.apiServices.get",
"container.apiServices.list",
"container.clusters.getCredentials",
"container.clusters.get",
"container.clusters.list",

This is just the minimum for the user to be able to log into the Kubernetes cluster and from there being able to apply Kubernetes RBACs.

In Kubernetes, we applied a Role, which provides list of pods in a specific namespace, and a role binding that specifies the group we just added to IAM.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: test-role
  namespace: custom-namespace
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-rolebinding
  namespace: custom-namespace
roleRef:
  kind: Role
  name: test-role
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: Group
    name: group_a@ourdomain.com

Everything looks good until now. But when trying to list the pods of this namespace with the user that belongs to the group "group_a@ourdomain.com", we get:

Error from server (Forbidden): pods is forbidden: User "my-user@ourdomain.com" cannot list resource "pods" in API group "" in the namespace "custom-namespace": requires one of "container.pods.list" permission(s).

Of course if I give container.pods.list to the group_a@ourdomain assigned role, I can list pods, but it opens for all namespaces, as this permission in GCloud is global.

What am I missing here?

Not sure if this is relevant, but our organisation in gcloud is called for example "my-company.io", while the groups for SSO are named "...@groups.my-company.io", and the gke-security-groups group was also created with the "groups.my-company.io" domain.

Also, if instead of a Group in the RoleBinding, I specify the user directly, it works.