Authentication and authorization for hosted control planes
A hosted control plane includes a built-in OAuth server that issues the access tokens used to authenticate to the API. After you create the hosted cluster, you can specify an identity provider for the OAuth server and use the Cloud Credential Operator to assign the IAM roles that cluster components need.