gcloud: Wed Jun 18 10:54:11 UTC 2025

gcloud/alpha/container/hub/scopes/add-app-operator-binding

@@ -5,12 +5,12 @@ NAME
 
 SYNOPSIS
     gcloud alpha container hub scopes add-app-operator-binding SCOPE
-        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        (--custom-role=CUSTOM_ROLE | --role=ROLE) (--group=GROUP | --user=USER)
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) One binding consists of an app operator principal (user/group) and
-    a role (view/edit/admin).
+    a role (view/edit/admin or a custom role).
 
     This command sets up the different permissions required for an app
     operator, including usage of fleet scopes, connect gateway, logging, and
@@ -66,6 +66,26 @@ EXAMPLES
       ▪ creates fleet scope RBAC role binding: role admin with a random ID
         for user person@google.com.
 
+    ---
+
+    The following command:
+
+        $ gcloud alpha container hub scopes add-app-operator-binding SCOPE \
+            --custom-role=my-custom-role --user=person@google.com \
+            --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role my-custom-role with a
+        random ID for user person@google.com.
+
+    For any tailored IAM permissions required when using a custom role, the
+    user or group can separately be granted additional IAM permissions on the
+    project.
+
 POSITIONAL ARGUMENTS
      Scope resource - The group of arguments defining the Fleet Scope. This
      represents a Cloud resource. (NOTE) Some attributes are not given
@@ -91,8 +111,14 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument SCOPE on the command line.
 
 REQUIRED FLAGS
-     --role=ROLE
-        Role to assign. ROLE must be one of: admin, edit, view.
+     Exactly one of these must be specified:
+
+       --custom-role=CUSTOM_ROLE
+          Custom role to assign to principal.
+
+       --role=ROLE
+          Predefined role to assign to principal (admin, edit, view). ROLE must
+          be one of: admin, edit, view.
 
      Exactly one of these must be specified: