gcloud: Wed Jul 27 08:55:33 UTC 2022

gcloud/container/hub/memberships/generate-gateway-rbac

@@ -0,0 +1,118 @@
+NAME
+    gcloud container hub memberships generate-gateway-rbac - generate RBAC
+        policy files for connected clusters by the user
+
+SYNOPSIS
+    gcloud container hub memberships generate-gateway-rbac [--anthos-support]
+        [--apply] [--context=CONTEXT] [--kubeconfig=KUBECONFIG]
+        [--membership=MEMBERSHIP] [--rbac-output-file=RBAC_OUTPUT_FILE]
+        [--revoke] [--role=ROLE] [--users=USERS] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud container hub memberships generate-gateway-rbac generates RBAC
+    policies to be used by Connect Gateway API.
+
+    Upon success, this command will write the output RBAC policy to the
+    designated local file in dry run mode.
+
+    Override RBAC policy: Y to override previous RBAC policy, N to stop. If
+    overriding the --role, Y will clean up the previous RBAC policy and then
+    apply the new one.
+
+EXAMPLES
+    The current implementation supports multiple modes:
+
+    Dry run mode to generate the RBAC policy file, and write to local
+    directory:
+
+        $ gcloud container hub memberships generate-gateway-rbac \
+            --membership=my-cluster \
+            --users=foo@example.com,\
+        test-acct@test-project.iam.gserviceaccount.com \
+            --role=clusterrole/cluster-admin --rbac-output-file=./rbac.yaml
+
+    Dry run mode to generate the RBAC policy, and print on screen:
+
+        $ gcloud container hub memberships generate-gateway-rbac \
+            --membership=my-cluster \
+            --users=foo@example.com,\
+        test-acct@test-project.iam.gserviceaccount.com \
+            --role=clusterrole/cluster-admin
+
+    Anthos support mode, generate the RBAC policy file with read-only
+    permission for TSE/Eng to debug customers' clusters:
+
+        $ gcloud container hub memberships generate-gateway-rbac \
+            --membership=my-cluster --anthos-support
+
+    Apply mode, generate the RBAC policy and apply it to the specified cluster:
+
+        $ gcloud container hub memberships generate-gateway-rbac \
+            --membership=my-cluster \
+            --users=foo@example.com,\
+        test-acct@test-project.iam.gserviceaccount.com \
+            --role=clusterrole/cluster-admin --context=my-cluster-contex \
+            --kubeconfig=/home/user/custom_kubeconfig --apply
+
+    Revoke mode, revoke the RBAC policy for the specified users:
+
+        $ gcloud container hub memberships generate-gateway-rbac \
+            --membership=my-cluster \
+            --users=foo@example.com,\
+        test-acct@test-project.iam.gserviceaccount.com \
+            --role=clusterrole/cluster-admin --context=my-cluster-contex \
+            --kubeconfig=/home/user/custom_kubeconfig --revoke
+
+FLAGS
+     --anthos-support
+        If specified, this command will generate RBAC policy file for anthos
+        support.
+
+     --apply
+        If specified, this command will generate RBAC policy and apply to the
+        specified cluster.
+
+     --context=CONTEXT
+        The cluster context as it appears in the kubeconfig file. You can get
+        this value from the command line by running command: kubectl config
+        current-context.
+
+     --kubeconfig=KUBECONFIG
+        The kubeconfig file containing an entry for the cluster. Defaults to
+        $KUBECONFIG if it is set in the environment, otherwise defaults to
+        $HOME/.kube/config.
+
+     --membership=MEMBERSHIP
+        Membership name to assign RBAC policy with.
+
+     --rbac-output-file=RBAC_OUTPUT_FILE
+        If specified, this command will execute in dry run mode and write to
+        the file specified with this flag: the generated RBAC policy will not
+        be applied to Kubernetes clusters,instead it will be written to the
+        designated local file.
+
+     --revoke
+        If specified, this command will revoke the RBAC policy for the
+        specified users.
+
+     --role=ROLE
+        Namespace scoped role or cluster role.
+
+     --users=USERS
+        User's email address or service account email address.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container hub memberships generate-gateway-rbac
+
+        $ gcloud beta container hub memberships generate-gateway-rbac
+

gcloud/container/hub/memberships/help

@@ -23,6 +23,9 @@ COMMANDS
      describe
         Describe a membership.
 
+     generate-gateway-rbac
+        Generate RBAC policy files for connected clusters by the user.
+
      get-credentials
         Fetch credentials for a fleet-registered cluster to be used in Connect
         Gateway.

gcloud/container/hub/memberships/register

@@ -173,9 +173,8 @@ REQUIRED FLAGS
             Enable Workload Identity when registering the cluster with a fleet.
             Ensure that GKE Workload Identity is enabled on your GKE cluster,
             it is a requirement for using Workload Identity with memberships.
-            Refer to the Registering a cluster using Workload Identity section
-            in
-            https://cloud.google.com/anthos/multicluster-management/connect/registering-a-cluster#register_cluster
+            Refer to the Enable GKE Workload Identity section in
+            https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable
             --service_account_key_file flag should not be set if this is set.
 
             This flag must be specified if any of the other arguments in this