Rollen und Berechtigungen

Auf dieser Seite werden die Berechtigungen aufgeführt, die für Google Distributed Cloud Connected erforderlich sind, sowie die IAM-Rollen (Identity and Access Management), die diese Berechtigungen umfassen.

Rollen und Berechtigungen für die Distributed Cloud Edge Container API

In der folgenden Tabelle sind die Google Cloud Projektrollen für die Distributed Cloud Edge Container API und die darin enthaltenen Berechtigungen für Distributed Cloud Connected aufgeführt.

Role	Permissions
Edge Container Admin (roles/edgecontainer.admin) Full access to Edge Container all resources.	edgecontainer.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.generateOfflineCredential edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.setIamPolicy edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.setIamPolicy edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.setIamPolicy edgecontainer.nodePools.update edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.setIamPolicy edgecontainer.vpnConnections.update edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy resourcemanager.projects.get resourcemanager.projects.list
Edgecontainer Editor (roles/edgecontainer.editor) Editor role for edgecontainer	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.update edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.* edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.update edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container Viewer (roles/edgecontainer.viewer) Read-only access to Edge Container all resources.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container API Key Admin (roles/edgecontainer.apiKeyAdmin) Access to manage API Keys.	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list
Edge Container API Key Viewer (roles/edgecontainer.apiKeyViewer) Read-only access to API Keys.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list
Edge Container Identity Provider Admin (roles/edgecontainer.identityProviderAdmin) Access to manage Identity Providers.	edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Identity Provider Viewer (roles/edgecontainer.identityProviderViewer) Read-only access to Identity Providers.	edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Machine User (roles/edgecontainer.machineUser) Access to use Edge Container Machine resources.	edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.use resourcemanager.projects.get resourcemanager.projects.list
Edge Container Cluster offline Credential User (roles/edgecontainer.offlineCredentialUser) Access to get Edge Container cluster offline credentials	edgecontainer.clusters.generateOfflineCredential resourcemanager.projects.get resourcemanager.projects.list
Edge Container Service Account Admin (roles/edgecontainer.serviceAccountAdmin) Access to manage Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Service Account Key Admin (roles/edgecontainer.serviceAccountKeyAdmin) Access to manage Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Key Viewer (roles/edgecontainer.serviceAccountKeyViewer) Access to view Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Viewer (roles/edgecontainer.serviceAccountViewer) Read-only access to Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Zonal Project Admin (roles/edgecontainer.zonalProjectAdmin) Access to manage zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Project Viewer (roles/edgecontainer.zonalProjectViewer) Read-only access to zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Service Admin (roles/edgecontainer.zonalServiceAdmin) Access to mutate zonal service.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zonal Service Viewer (roles/edgecontainer.zonalServiceViewer) Read-only access to zonal services.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zone Iam Policy Admin (roles/edgecontainer.zoneIamAdmin) Access to manage Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy
Edge Container Zone Iam Policy Viewer (roles/edgecontainer.zoneIamViewer) Read-only access to Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy
Edge Container Roles Viewer (roles/edgecontainer.zoneRolesViewer) Read-only access to Roles in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.listRoles
Edge Container Zone Viewer (roles/edgecontainer.zoneViewer) Read-only access to zones.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zones.get edgecontainer.zones.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Edge Container Cluster Service Agent (roles/edgecontainer.clusterServiceAgent) Grants the Edge Container Cluster Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	cloudnotifications.activities.list gkehub.endpoints.connect gkehub.features.create gkehub.features.get gkehub.features.list gkehub.features.update gkehub.fleet.create gkehub.fleet.delete gkehub.fleet.get gkehub.locations.* gkehub.locations.get gkehub.locations.list gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.* gkehub.operations.cancel gkehub.operations.delete gkehub.operations.get gkehub.operations.list kubernetesmetadata.* kubernetesmetadata.metadata.config kubernetesmetadata.metadata.publish kubernetesmetadata.metadata.snapshot logging.logEntries.create monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.create monitoring.dashboards.delete monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.update monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.* opsconfigmonitoring.resourceMetadata.list opsconfigmonitoring.resourceMetadata.write resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.contentsecuritypolicy.get serviceusage.effectivemcppolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.mcppolicy.get serviceusage.operations.get serviceusage.quotas.get serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test stackdriver.projects.get stackdriver.resourceMetadata.* stackdriver.resourceMetadata.list stackdriver.resourceMetadata.write storage.buckets.create storage.buckets.get storage.buckets.list storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Edge Container Service Agent (roles/edgecontainer.serviceAgent) Grants the Edge Container Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	compute.externalVpnGateways.create compute.externalVpnGateways.delete compute.externalVpnGateways.get compute.externalVpnGateways.use compute.globalOperations.get compute.networks.get compute.networks.updatePolicy compute.regionOperations.get compute.routers.create compute.routers.delete compute.routers.get compute.routers.list compute.routers.update compute.routers.use compute.vpnGateways.create compute.vpnGateways.delete compute.vpnGateways.get compute.vpnGateways.use compute.vpnTunnels.create compute.vpnTunnels.delete compute.vpnTunnels.get gkehub.features.create gkehub.features.get gkehub.features.update gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.cancel gkehub.operations.get serviceusage.services.get serviceusage.services.list

Rollen und Berechtigungen für die Distributed Cloud Edge Network API

In der folgenden Tabelle sind die Google Cloud Projektrollen für die Distributed Cloud Edge Network API und die darin enthaltenen Berechtigungen für Distributed Cloud Connected aufgeführt.

Role	Permissions
Edge Network Admin (roles/edgenetwork.admin) Full access to Edge Network all resources.	edgenetwork.* edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.setIamPolicy edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.interconnects.setIamPolicy edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.setIamPolicy edgenetwork.networks.update edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.setIamPolicy edgenetwork.routers.update edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.setIamPolicy edgenetwork.subnetworks.update edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Editor (roles/edgenetwork.editor) Editor role for Edge Network	edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.update edgenetwork.operations.* edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.update edgenetwork.routes.* edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.update edgenetwork.zones.* edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Viewer (roles/edgenetwork.viewer) Read-only access to Edge Network all resources.	edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.zones.get edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list

Rollen und Berechtigungen für die GDC Hardware Management API

In der folgenden Tabelle sind die Google Cloud Projektrollen für die GDC Hardware Management API und die darin enthaltenen Berechtigungen für Distributed Cloud Connected aufgeführt.

Role	Permissions
GDC Hardware Management Admin ^Beta (roles/gdchardwaremanagement.admin) Full access to GDC Hardware Management resources.	gdchardwaremanagement.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.cancel gdchardwaremanagement.operations.delete gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.delete gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.submit gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.delete gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
Gdchardwaremanagement Viewer ^Beta (roles/gdchardwaremanagement.viewer) Viewer role for gdchardwaremanagement	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Operator ^Beta (roles/gdchardwaremanagement.operator) Create, read, and update access to GDC Hardware Management resources that support those operations. Also grants delete access to HardwareGroup resource.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.* gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.* gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.* gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.* gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Reader ^Beta (roles/gdchardwaremanagement.reader) Readonly access to GDC Hardware Management resources.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list

Connect-Gateway-Rollen und ‑Berechtigungen

In der folgenden Liste werden die Google Cloud Projekrollen beschrieben, die für den Zugriff des Connect-Gateways auf Ihre Cluster erforderlich sind.

• Connect Gateway-Administrator (roles/gkehub.gatewayAdmin): Gewährt Zugriff auf die Connect Gateway API. Mit dieser Rolle kann das kubectl-Befehlszeilentool zum Verwalten des Clusters verwendet werden.
• Connect Gateway-Bearbeiter (roles/gkehub.gatewayEditor): Gewährt Lese- und Schreibzugriff auf den Cluster.
• Connect Gateway-Leser (roles/gkehub.gatewayReader): Gewährt Lesezugriff auf den Cluster.
• GKE Hub-Betrachter (roles/gkehub.viewer): Ermöglicht das Abrufen von kubeconfig-Dateien aus dem Cluster.

Rollen und Berechtigungen für Config Sync-Flottenpakete

In der folgenden Liste werden die Google Cloud Projekrollen beschrieben, die zum Erstellen und Verwalten von Flottenpaketen erforderlich sind.

• Config Delivery Admin (roles/configdelivery.admin): erforderlich, um Flottenpakete und Rollouts zu erstellen und zu verwalten.
• Developer Connect Admin (roles/developerconnect.admin): Erforderlich zum Erstellen und Verwalten von Repository-Verbindungen.
• Projekt-IAM-Administrator (roles/resourcemanager.projectIamAdmin): erforderlich, um dem Dienstkonto die erforderlichen Rollen zuzuweisen.

Rollen für Dienstkonto für Flottenpaket

• Config Delivery Resource Bundle Publisher (roles/configdelivery.resourceBundlePublisher): Ermöglicht dem Dienstkonto, Ressourcen-Bundles und Releases zu erstellen und zu verwalten.
• Cloud Build Connection User (roles/cloudbuild.connectionUser): Ermöglicht dem Dienstkonto, die Cloud Build-Repository-Verbindung zu verwenden.
• Logging Log Writer (roles/logging.logWriter): Ermöglicht dem Dienstkonto, Build-Logs zu schreiben.
• Artifact Registry-Autor (roles/artifactregistry.writer): Ermöglicht dem Dienstkonto, versionierte Paket-Bundles in Artifact Registry zu übertragen.
• Developer Connect Connection User (roles/developerconnect.connectionUser): Ermöglicht dem Dienstkonto, die Developer Connect-Verbindung zu verwenden.

RBAC-Rollen im Cluster für die VM-Laufzeit in GDC

VM Runtime on GDC verwendet die rollenbasierte Zugriffssteuerung (Role-Based Access Control, RBAC), um Berechtigungen für verwaltete Ressourcen im Cluster festzulegen und zu erzwingen. Berechtigungen werden von der Identitäts- und Zugriffsverwaltung (Identity and Access Management, IAM) auf die lokale Kubernetes-RBAC abgebildet, die über die Flottenmitgliedschaft verwaltet wird.

VM Runtime on GDC bietet vier vorkonfigurierte ClusterRoles. In der folgenden Liste werden diese Rollen beschrieben.

• kubevm.admin: Gewährt vollständigen Zugriff auf alle VM-bezogenen Ressourcen.
• kubevm.edit: Gewährt Lese- und Schreibzugriff auf alle VM-bezogenen Ressourcen.
• kubevm.view: Gewährt Lesezugriff auf alle VM-bezogenen Ressourcen.
• kubevm.cluster.view: Gewährt Lesezugriff auf clusterweite Ressourcen.

Diese Rollen werden in den folgenden Kubernetes-Standardrollen zusammengefasst:

• kubevm.admin wird admin zugeordnet.
• kubevm.edit wird edit zugeordnet.
• kubevm.view wird view zugeordnet.

Nutzer mit der Standardrolle edit erhalten automatisch die Berechtigungen kubevm.edit.