Least privilege IAM setup for managing a GKE private cluster using a bastion host

Question

I would like to create a bastion host to manage a private GKE cluster on GCP.

• The bastion host is a GCE VM named bastion.
• The cluster is a GKE