GKE Autopilot cluster access via Teleport

[colinedwardwood]

In order to access GKE Autopilot clusters via the teleport-kube-agent special configurations are required due to limitations placed on the Autopilot clusters by GCP.

The limitation,

User impersonation limitation
GKE version 1.22.4-gke.1501 and later support user impersonation for all user-defined users and groups. System users and groups such as the kube-apiserver user and the system:masters group cannot be impersonated.

Therefore, in order to use Teleport with GKE Autopilot clusters:

1. Your GKE Autopilot cluster must be deployed with "Release channel" set to "Rapid channel." This may not be a requirement in the near future as the Regular channel will eventually catch up but at present, the Regular channel deploys releases less than 1.22.4-gke.1501 which are incompatible with impersonation. As of this writing, the "Rapid channel" deployed v1.22.8-gke.200
2. You cannot use system or admin roles. GKE Autopilot does not allow impersonation of system roles but does allow impersonation of user-defined roles. If you create your own Kubernetes roles you will be able to connect with those roles via Teleport.