Create storage WORM buckets for projects

This page shows you how to create Google Distributed Cloud (GDC) air-gapped storage WORM buckets.

Before you begin

A project namespace manages bucket resources in the management API server. You must have a project to work with buckets and objects.

Required IAM roles

Contact your IAM Project Admin to request the following roles in your project namespace:

• Project Bucket Admin (project-bucket-admin): create, update, and delete storage buckets.
• Project Bucket Object Viewer (project-bucket-object-viewer): view and check details of storage buckets and objects.

For more information, see Grant bucket access.

Prepare your environment

To run commands against the management API server or the global API server, do the following:

1. Sign in and generate the kubeconfig file for the zonal management API server if you don't have one.
2. For dual-zone buckets, do the following:
   • Verify with your Infrastructure Operator (IO) that the BucketLocationConfig custom resource has been created for your paired zones.
   • Generate the kubeconfig file for the global API server.

Create a WORM bucket

A WORM bucket ensures that nothing else overwrites objects and it retains them for a minimum period of time. Audit logging is an example use case for a WORM bucket.

Note: If you attempt to overwrite an object in a WORM bucket, you will add a new version of the object. Only after a WORM object's retention period, as dictated by the bucket locking policy, is over can you proceed with object, bucket, and project deletion.

Take the following steps to create a WORM bucket:

1. Set a retention period when creating the bucket. The retention period defines how many days each object version is locked against deletion or modification. This retention period is distinct from the storage class minimum storage duration (such as the 30-day minimum for the Standard storage class). For example, the following bucket sets a retention period of 365 days. Contact your Infrastructure Operator (IO) if you need to exceed retention policy limits.

   apiVersion: object.gdc.goog/v1
   kind: Bucket
   metadata:
     name: foo-logging-bucket
     namespace: foo-service
   spec:
     description: "Audit logs for foo"
     storageClass: Standard
     bucketPolicy:
       lockingPolicy:
         defaultObjectRetentionDays: 365
   

2. Grant the project-bucket-object-viewer role to all users who need read-only access:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     namespace: foo-service
     name: object-readonly-access
   roleRef:
     kind: Role
     name: project-bucket-object-viewer
     apiGroup: rbac.authorization.k8s.io
   subjects:
   - kind: ServiceAccount
     namespace: foo-service
     name: foo-log-processor
   - kind: User
     name: [e-mail]
     apiGroup: rbac.authorization.k8s.io
   

3. Grant the project-bucket-object-admin role to users who need to write content to the bucket:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     namespace: foo-service
     name: object-write-access
   roleRef:
     kind: Role
     name: project-bucket-object-admin
     apiGroup: rbac.authorization.k8s.io
   subjects:
   - kind: ServiceAccount
     namespace: foo-service
     name: foo-service-account