Rôles et autorisations

Cette page liste les autorisations requises par Google Distributed Cloud Connected et les rôles Identity and Access Management (IAM) qui les englobent.

Rôles et autorisations de l'API Distributed Cloud Edge Container

Le tableau suivant répertorie les rôles de projet Google Cloud pour l'API Distributed Cloud Edge Container et les autorisations Distributed Cloud connectées qu'ils englobent.

Role	Permissions
Edge Container Admin (roles/edgecontainer.admin) Full access to Edge Container all resources.	edgecontainer.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.generateOfflineCredential edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.setIamPolicy edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.setIamPolicy edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.setIamPolicy edgecontainer.nodePools.update edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.setIamPolicy edgecontainer.vpnConnections.update edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy resourcemanager.projects.get resourcemanager.projects.list
Edgecontainer Editor (roles/edgecontainer.editor) Editor role for edgecontainer	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.update edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.* edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.update edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container Viewer (roles/edgecontainer.viewer) Read-only access to Edge Container all resources.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container API Key Admin (roles/edgecontainer.apiKeyAdmin) Access to manage API Keys.	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list
Edge Container API Key Viewer (roles/edgecontainer.apiKeyViewer) Read-only access to API Keys.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list
Edge Container Identity Provider Admin (roles/edgecontainer.identityProviderAdmin) Access to manage Identity Providers.	edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Identity Provider Viewer (roles/edgecontainer.identityProviderViewer) Read-only access to Identity Providers.	edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Machine User (roles/edgecontainer.machineUser) Access to use Edge Container Machine resources.	edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.use resourcemanager.projects.get resourcemanager.projects.list
Edge Container Cluster offline Credential User (roles/edgecontainer.offlineCredentialUser) Access to get Edge Container cluster offline credentials	edgecontainer.clusters.generateOfflineCredential resourcemanager.projects.get resourcemanager.projects.list
Edge Container Service Account Admin (roles/edgecontainer.serviceAccountAdmin) Access to manage Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Service Account Key Admin (roles/edgecontainer.serviceAccountKeyAdmin) Access to manage Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Key Viewer (roles/edgecontainer.serviceAccountKeyViewer) Access to view Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Viewer (roles/edgecontainer.serviceAccountViewer) Read-only access to Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Zonal Project Admin (roles/edgecontainer.zonalProjectAdmin) Access to manage zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Project Viewer (roles/edgecontainer.zonalProjectViewer) Read-only access to zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Service Admin (roles/edgecontainer.zonalServiceAdmin) Access to mutate zonal service.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zonal Service Viewer (roles/edgecontainer.zonalServiceViewer) Read-only access to zonal services.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zone Iam Policy Admin (roles/edgecontainer.zoneIamAdmin) Access to manage Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy
Edge Container Zone Iam Policy Viewer (roles/edgecontainer.zoneIamViewer) Read-only access to Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy
Edge Container Roles Viewer (roles/edgecontainer.zoneRolesViewer) Read-only access to Roles in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.listRoles
Edge Container Zone Viewer (roles/edgecontainer.zoneViewer) Read-only access to zones.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zones.get edgecontainer.zones.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Edge Container Cluster Service Agent (roles/edgecontainer.clusterServiceAgent) Grants the Edge Container Cluster Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	cloudnotifications.activities.list gkehub.endpoints.connect gkehub.features.create gkehub.features.get gkehub.features.list gkehub.features.update gkehub.fleet.create gkehub.fleet.delete gkehub.fleet.get gkehub.locations.* gkehub.locations.get gkehub.locations.list gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.* gkehub.operations.cancel gkehub.operations.delete gkehub.operations.get gkehub.operations.list kubernetesmetadata.* kubernetesmetadata.metadata.config kubernetesmetadata.metadata.publish kubernetesmetadata.metadata.snapshot logging.logEntries.create monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.create monitoring.dashboards.delete monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.update monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.* opsconfigmonitoring.resourceMetadata.list opsconfigmonitoring.resourceMetadata.write resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.contentsecuritypolicy.get serviceusage.effectivemcppolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.mcppolicy.get serviceusage.operations.get serviceusage.quotas.get serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test stackdriver.projects.get stackdriver.resourceMetadata.* stackdriver.resourceMetadata.list stackdriver.resourceMetadata.write storage.buckets.create storage.buckets.get storage.buckets.list storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Edge Container Service Agent (roles/edgecontainer.serviceAgent) Grants the Edge Container Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	compute.externalVpnGateways.create compute.externalVpnGateways.delete compute.externalVpnGateways.get compute.externalVpnGateways.use compute.globalOperations.get compute.networks.get compute.networks.updatePolicy compute.regionOperations.get compute.routers.create compute.routers.delete compute.routers.get compute.routers.list compute.routers.update compute.routers.use compute.vpnGateways.create compute.vpnGateways.delete compute.vpnGateways.get compute.vpnGateways.use compute.vpnTunnels.create compute.vpnTunnels.delete compute.vpnTunnels.get gkehub.features.create gkehub.features.get gkehub.features.update gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.cancel gkehub.operations.get serviceusage.services.get serviceusage.services.list

Rôles et autorisations de l'API Distributed Cloud Edge Network

Le tableau suivant répertorie les rôles de projet Google Cloud pour l'API Distributed Cloud Edge Network et les autorisations Distributed Cloud associées.

Role	Permissions
Edge Network Admin (roles/edgenetwork.admin) Full access to Edge Network all resources.	edgenetwork.* edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.setIamPolicy edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.interconnects.setIamPolicy edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.setIamPolicy edgenetwork.networks.update edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.setIamPolicy edgenetwork.routers.update edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.setIamPolicy edgenetwork.subnetworks.update edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Editor (roles/edgenetwork.editor) Editor role for Edge Network	edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.update edgenetwork.operations.* edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.update edgenetwork.routes.* edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.update edgenetwork.zones.* edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Viewer (roles/edgenetwork.viewer) Read-only access to Edge Network all resources.	edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.zones.get edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list

Rôles et autorisations de l'API GDC Hardware Management

Le tableau suivant répertorie les rôles de projet Google Cloud pour l'API GDC Hardware Management et les autorisations Distributed Cloud associées.

Role	Permissions
GDC Hardware Management Admin ^Beta (roles/gdchardwaremanagement.admin) Full access to GDC Hardware Management resources.	gdchardwaremanagement.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.cancel gdchardwaremanagement.operations.delete gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.delete gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.submit gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.delete gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
Gdchardwaremanagement Viewer ^Beta (roles/gdchardwaremanagement.viewer) Viewer role for gdchardwaremanagement	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Operator ^Beta (roles/gdchardwaremanagement.operator) Create, read, and update access to GDC Hardware Management resources that support those operations. Also grants delete access to HardwareGroup resource.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.* gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.* gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.* gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.* gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Reader ^Beta (roles/gdchardwaremanagement.reader) Readonly access to GDC Hardware Management resources.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list

Rôles et autorisations de la passerelle Connect

La liste suivante décrit les rôles de projet Google Cloud nécessaires à la passerelle de connexion pour accéder à vos clusters.

• Administrateur Connect Gateway (roles/gkehub.gatewayAdmin) : accorde l'accès à l'API Connect Gateway. Ce rôle permet d'utiliser l'outil de ligne de commande kubectl pour gérer le cluster.
• Éditeur de la passerelle Connect (roles/gkehub.gatewayEditor) : accorde un accès en lecture et en écriture au cluster.
• Lecteur Connect Gateway (roles/gkehub.gatewayReader) : accorde un accès en lecture seule au cluster.
• Lecteur GKE Hub (roles/gkehub.viewer) : permet de récupérer les fichiers kubeconfig du cluster.

Rôles et autorisations des packages de parc Config Sync

La liste suivante décrit les rôles de projet Google Cloud requis pour créer et gérer des packages de parc.

• Administrateur Config Delivery (roles/configdelivery.admin) : requis pour créer et gérer les packages et les déploiements de parc.
• Administrateur Developer Connect (roles/developerconnect.admin) : rôle requis pour créer et gérer les connexions de dépôt.
• Administrateur IAM du projet (roles/resourcemanager.projectIamAdmin) : requis pour accorder les rôles nécessaires au compte de service.

Rôles de compte de service du package de parc

• Éditeur de groupe de ressources Config Delivery (roles/configdelivery.resourceBundlePublisher) : permet au compte de service de créer et de gérer des groupes de ressources et des versions.
• Utilisateur de la connexion Cloud Build (roles/cloudbuild.connectionUser) : permet au compte de service d'utiliser la connexion au dépôt Cloud Build.
• Rédacteur de journaux Logging (roles/logging.logWriter) : permet au compte de service d'écrire des journaux de compilation.
• Rédacteur Artifact Registry (roles/artifactregistry.writer) : permet au compte de service d'envoyer des packages groupés versionnés vers Artifact Registry.
• Utilisateur de connexion Developer Connect (roles/developerconnect.connectionUser) : permet au compte de service d'utiliser la connexion Developer Connect.

Rôles RBAC dans le cluster pour l'environnement d'exécution de VM sur GDC

L'environnement d'exécution des VM sur GDC utilise le contrôle des accès basé sur les rôles (RBAC) pour définir et appliquer des autorisations aux ressources gérées dans le cluster. Les autorisations sont mappées d'Identity and Access Management au RBAC Kubernetes local, géré par l'appartenance au parc.

L'environnement d'exécution de VM sur GDC fournit quatre ClusterRoles préconfigurés. La liste suivante décrit ces rôles.

• kubevm.admin : accorde un accès complet à toutes les ressources liées aux VM.
• kubevm.edit : accorde un accès en lecture et en écriture à toutes les ressources liées aux VM.
• kubevm.view : accorde un accès en lecture à toutes les ressources liées aux VM.
• kubevm.cluster.view : accorde un accès en lecture aux ressources à l'échelle du cluster.

Ces rôles sont agrégés aux rôles Kubernetes par défaut suivants :

• kubevm.admin correspond à admin
• kubevm.edit correspond à edit
• kubevm.view correspond à view

Les utilisateurs disposant du rôle edit par défaut obtiennent automatiquement les autorisations kubevm.edit.