gcloud: Wed Jul 17 09:30:28 UTC 2024

gcloud/alpha/container/hub/scopes/help

@@ -48,6 +48,11 @@ COMMANDS
         (ALPHA) List fleet scopes in a project permitted to be viewed by the
         caller.
 
+     list-app-operator-bindings
+        (ALPHA) List app operator principals corresponding to a fleet scope and
+        their roles based on project-level IAM bindings, fleet scope-level IAM
+        bindings, and fleet scope RBAC role bindings.
+
      list-memberships
         (ALPHA) List memberships bound to a fleet scope.
 

gcloud/alpha/container/hub/scopes/list-app-operator-bindings

@@ -0,0 +1,106 @@
+NAME
+    gcloud alpha container hub scopes list-app-operator-bindings - list app
+        operator principals corresponding to a fleet scope and their roles
+        based on project-level IAM bindings, fleet scope-level IAM bindings,
+        and fleet scope RBAC role bindings
+
+SYNOPSIS
+    gcloud alpha container hub scopes list-app-operator-bindings SCOPE
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command lists bindings corresponding to a fleet scope. The
+    bindings, which consist of an app operator principal and a role, grant
+    permissions required for an app operator, including usage of fleet scopes,
+    connect gateway, logging, and metrics. The overarching principal role
+    (view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
+    (view, edit, or admin), (2) the fleet scope-level IAM role
+    (roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
+    roles/gkehub.scopeAdmin), (3) the project-level IAM role
+    (roles/gkehub.scopeViewerProjectLevel, or
+    roles/gkehub.scopeEditorProjectLevel), and (4) the conditional log view
+    access role for the scope bucket.
+
+    This command can fail for the following reasons:
+      ▪ The scope specified does not exist.
+      ▪ The user does not have access to the specified scope.
+
+EXAMPLES
+    The following command lists app operator principals corresponding to SCOPE
+    under PROJECT_ID, their roles, and role details (fleet scope RBAC role,
+    fleet scope-level IAM role, project-level IAM role, and log view access):
+
+        $ gcloud alpha container hub scopes list-app-operator-bindings \
+            --scope=SCOPE --project=PROJECT_ID
+
+POSITIONAL ARGUMENTS
+     Scope resource - The group of arguments defining the Fleet Scope. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     To set the location attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ global is the only supported location.
+
+     This must be specified.
+
+       SCOPE
+          ID of the scope or fully qualified identifier for the scope.
+
+          To set the scope attribute:
+          ▸ provide the argument SCOPE on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+