imjasonh/gcloud-help
1
0
Fork 0
mirror of https://github.com/imjasonh/gcloud-help synced 2026-07-18 23:08:48 +00:00
Code Activity

gcloud: Wed Oct 9 09:55:07 UTC 2024

Browse source
This commit is contained in:
Automated 2024-10-09 09:55:07 +00:00
parent 489be55d99
commit 4ffb04ab9e
211 changed files with 7635 additions and 1232 deletions
Download patch file Download diff file Expand all files Collapse all files

127
gcloud/beta/container/hub/scopes/add-app-operator-binding Normal file
View file

@ -0,0 +1,127 @@
NAME
gcloud beta container hub scopes add-app-operator-binding - add
project-level and fleet scope-level IAM bindings and create a fleet
scope RBAC role binding for an app operator principal
SYNOPSIS
gcloud beta container hub scopes add-app-operator-binding SCOPE --role=ROLE
(--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) One binding consists of an app operator principal (user/group) and a
role (view/edit/admin).
This command sets up the different permissions required for an app
operator, including usage of fleet scopes, connect gateway, logging, and
metrics. The authoritative list for adding the permissions is the existing
RBAC role bindings under the specified scope.
This command can fail for the following reasons:
▪ The scope specified does not exist.
▪ The user does not have access to the specified scope.
▪ The principal specified already has another binding for the scope.
EXAMPLES
The following command:
$ gcloud beta container hub scopes add-app-operator-binding SCOPE \
--role=view --group=people@google.com --project=PROJECT_ID
▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
▪ adds IAM policy binding: roles/gkehub.scopeViewerProjectLevel on
PROJECT_ID
▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
with condition where bucket corresponds to SCOPE
▪ creates fleet scope RBAC role binding: role view with a random ID for
group people@google.com.
---
The following command:
$ gcloud beta container hub scopes add-app-operator-binding SCOPE \
--role=edit --user=person@google.com --project=PROJECT_ID
▪ adds IAM policy binding: roles/gkehub.scopeEditor on SCOPE
▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
PROJECT_ID
▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
with condition where bucket corresponds to SCOPE
▪ creates fleet scope RBAC role binding: role edit with a random ID for
user person@google.com.
---
The following command:
$ gcloud beta container hub scopes add-app-operator-binding SCOPE \
--role=admin --user=person@google.com --project=PROJECT_ID
▪ adds IAM policy binding: roles/gkehub.scopeAdmin on SCOPE
▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
PROJECT_ID
▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
with condition where bucket corresponds to SCOPE
▪ creates fleet scope RBAC role binding: role admin with a random ID
for user person@google.com.
POSITIONAL ARGUMENTS
Scope resource - The group of arguments defining the Fleet Scope. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways.
To set the project attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ provide the argument --project on the command line;
◆ set the property core/project.
To set the location attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ global is the only supported location.
This must be specified.
SCOPE
ID of the scope or fully qualified identifier for the scope.
To set the scope attribute:
▸ provide the argument SCOPE on the command line.
REQUIRED FLAGS
--role=ROLE
Role to assign. ROLE must be one of: admin, edit, view.
Exactly one of these must be specified:
--group=GROUP
Group for the role binding.
--user=USER
User for the role binding.
OPTIONAL FLAGS
--labels=[KEY=VALUE,...]
List of label KEY=VALUE pairs to add.
Keys must start with a lowercase character and contain only hyphens
(-), underscores (_), lowercase characters, and numbers. Values must
contain only hyphens (-), underscores (_), lowercase characters, and
numbers.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha container hub scopes add-app-operator-binding

13
gcloud/beta/container/hub/scopes/help
View file

@ -25,6 +25,10 @@ GROUPS
COMMANDS
COMMAND is one of the following:
add-app-operator-binding
(BETA) Add project-level and fleet scope-level IAM bindings and create
a fleet scope RBAC role binding for an app operator principal.
add-iam-policy-binding
(BETA) Add IAM policy binding to a Fleet Scope.
@ -44,9 +48,18 @@ COMMANDS
(BETA) List fleet scopes in a project permitted to be viewed by the
caller.
list-app-operator-bindings
(BETA) List app operator principals corresponding to a fleet scope and
their roles based on project-level IAM bindings, fleet scope-level IAM
bindings, and fleet scope RBAC role bindings.
list-memberships
(BETA) List memberships bound to a fleet scope.
remove-app-operator-binding
(BETA) Remove project-level and fleet scope-level IAM bindings and
delete a fleet scope RBAC role binding for an app operator principal.
remove-iam-policy-binding
(BETA) Remove IAM policy binding of a Fleet Scope.

106
gcloud/beta/container/hub/scopes/list-app-operator-bindings Normal file
View file

@ -0,0 +1,106 @@
NAME
gcloud beta container hub scopes list-app-operator-bindings - list app
operator principals corresponding to a fleet scope and their roles
based on project-level IAM bindings, fleet scope-level IAM bindings,
and fleet scope RBAC role bindings
SYNOPSIS
gcloud beta container hub scopes list-app-operator-bindings SCOPE
[--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
[--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command lists bindings corresponding to a fleet scope. The
bindings, which consist of an app operator principal and a role, grant
permissions required for an app operator, including usage of fleet scopes,
connect gateway, logging, and metrics. The overarching principal role
(view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
(view, edit, or admin), (2) the fleet scope-level IAM role
(roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
roles/gkehub.scopeAdmin), (3) the project-level IAM role
(roles/gkehub.scopeViewerProjectLevel, or
roles/gkehub.scopeEditorProjectLevel), and (4) the conditional log view
access role for the scope bucket.
This command can fail for the following reasons:
▪ The scope specified does not exist.
▪ The user does not have access to the specified scope.
EXAMPLES
The following command lists app operator principals corresponding to SCOPE
under PROJECT_ID, their roles, and role details (fleet scope RBAC role,
fleet scope-level IAM role, project-level IAM role, and log view access):
$ gcloud beta container hub scopes list-app-operator-bindings \
--scope=SCOPE --project=PROJECT_ID
POSITIONAL ARGUMENTS
Scope resource - The group of arguments defining the Fleet Scope. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways.
To set the project attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ provide the argument --project on the command line;
◆ set the property core/project.
To set the location attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ global is the only supported location.
This must be specified.
SCOPE
ID of the scope or fully qualified identifier for the scope.
To set the scope attribute:
▸ provide the argument SCOPE on the command line.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is
determined by the service if it supports paging, otherwise it is
unlimited (no paging). Paging may be applied before or after --filter
and --limit depending on the service.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
--uri
Print a list of resource URIs instead of the default output, and change
the command output to a list of URIs. If this flag is used with
--format, the formatting is applied on this URI list. To display URIs
alongside other keys instead, use the uri() transform.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha container hub scopes list-app-operator-bindings

122
gcloud/beta/container/hub/scopes/remove-app-operator-binding Normal file
View file

@ -0,0 +1,122 @@
NAME
gcloud beta container hub scopes remove-app-operator-binding - remove
project-level and fleet scope-level IAM bindings and delete a fleet
scope RBAC role binding for an app operator principal
SYNOPSIS
gcloud beta container hub scopes remove-app-operator-binding SCOPE
(--group=GROUP | --user=USER) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) One binding consists of an app operator principal (user/group) and a
role (view/edit/admin).
This command unsets the different permissions required for an app operator,
including usage of fleet scopes, connect gateway, logging, and metrics. The
authoritative list for removing the permissions is the existing RBAC role
bindings under the specified scope.
This command can fail for the following reasons:
▪ The scope specified does not exist.
▪ The user does not have access to the specified scope.
▪ The principal specified does not any binding for the scope.
▪ The principal specified has bindings with different roles for the
scope.
EXAMPLES
The following command:
$ gcloud beta container hub scopes remove-app-operator-binding \
SCOPE --group=people@google.com --project=PROJECT_ID
assuming the group already has the view role:
▪ removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
▪ removes IAM policy binding: roles/gkehub.scopeViewerProjectLevel from
PROJECT_ID if the group does not have the view role for any other scope
under the project
▪ removes IAM policy binding: roles/logging.viewAccessor from
PROJECT_ID condition where bucket corresponds to SCOPE
▪ deletes existing fleet scope RBAC role binding: role view for group
people@google.com.
---
The following command:
$ gcloud beta container hub scopes remove-app-operator-binding \
SCOPE --user=person@google.com --project=PROJECT_ID
assuming the user already has the edit role:
▪ removes IAM policy binding: roles/gkehub.scopeEditor from SCOPE
▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
PROJECT_ID if the user does not have the edit/admin role for any other
scope under the project
▪ removes IAM policy binding: roles/logging.viewAccessor from
PROJECT_ID condition where bucket corresponds to SCOPE
▪ deletes existing fleet scope RBAC role binding: role edit for user
person@google.com.
---
The following command:
$ gcloud beta container hub scopes remove-app-operator-binding \
SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
assuming the user already has the admin role:
▪ removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
PROJECT_ID if the user does not have the edit/admin role for any other
scope under the project
▪ removes IAM policy binding: roles/logging.viewAccessor from
PROJECT_ID condition where bucket corresponds to SCOPE
▪ deletes existing fleet scope RBAC role binding: role admin for user
person@google.com.
POSITIONAL ARGUMENTS
Scope resource - The group of arguments defining the Fleet Scope. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways.
To set the project attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ provide the argument --project on the command line;
◆ set the property core/project.
To set the location attribute:
◆ provide the argument SCOPE on the command line with a fully specified
name;
◆ global is the only supported location.
This must be specified.
SCOPE
ID of the scope or fully qualified identifier for the scope.
To set the scope attribute:
▸ provide the argument SCOPE on the command line.
REQUIRED FLAGS
Exactly one of these must be specified:
--group=GROUP
Group for the role binding.
--user=USER
User for the role binding.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha container hub scopes remove-app-operator-binding