使用 IAM 进行访问权限控制

Beta 版

本产品或功能须遵守服务专用条款的“通用服务条款”部分中的“非正式版产品条款”。 正式发布前产品和功能“按原样”提供，可能仅提供有限支持。 如需了解详情，请参阅发布阶段说明。

在机器学习流水线访问 Google Cloud 资源时，AI Platform Pipelines 依赖于 Identity and Access Management (IAM) 角色来为用户、组和服务授权。

本文档介绍了执行以下操作时所需的角色：

• 设置 AI Platform Pipelines。
• 使用用户管理的服务账号运行 AI Platform Pipelines。
• 以用户身份访问 AI Platform Pipelines。

详细了解 IAM 概念以及 IAM 的工作原理。

设置 AI Platform Pipelines 时所需的角色

要部署 AI Platform Pipelines，您必须获得项目的 Viewer (roles/viewer) 和 Kubernetes Engine Admin (roles/container.admin) 角色。 Viewer 角色提供对项目内所有资源的读取权限。Kubernetes Engine Admin 角色提供对 Kubernetes 集群和 Kubernetes API 对象的完整访问权限。

请将 AI Platform Pipelines 集群设置为使用精细访问权限，以便遵循最小权限原则。要为您的集群设置精细访问权限，您还必须拥有项目的 Service Account Admin (roles/iam.serviceAccountAdmin) 角色。Service Account Admin 角色提供创建和配置 IAM 服务账号的权限。

详细了解如何为 IAM 角色授予访问权限。

角色	权限
Viewer (roles/viewer)	拥有执行不会影响状态的只读操作的权限，例如查看（但无法修改）一个项目中的现有资源或数据。
Kubernetes Engine Admin (roles/container.admin) 提供对集群及其 Kubernetes API 对象的完整管理权限。 如需在节点上设置服务账号，您还必须具有节点将使用的用户管理的服务账号上的 Service Account User 角色 (roles/iam.serviceAccountUser)。 您可以授予此角色的最低级层资源： 项目	container.* container.apiServices.create container.apiServices.delete container.apiServices.get container.apiServices.getStatus container.apiServices.list container.apiServices.update container.apiServices.updateStatus container.auditSinks.create container.auditSinks.delete container.auditSinks.get container.auditSinks.list container.auditSinks.update container.backendConfigs.create container.backendConfigs.delete container.backendConfigs.get container.backendConfigs.list container.backendConfigs.update container.bindings.create container.bindings.delete container.bindings.get container.bindings.list container.bindings.update container.certificateSigningRequests.approve container.certificateSigningRequests.create container.certificateSigningRequests.delete container.certificateSigningRequests.get container.certificateSigningRequests.getStatus container.certificateSigningRequests.list container.certificateSigningRequests.update container.certificateSigningRequests.updateStatus container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.connect container.clusters.create container.clusters.createTagBinding container.clusters.delete container.clusters.deleteTagBinding container.clusters.get container.clusters.getCredentials container.clusters.impersonate container.clusters.list container.clusters.listEffectiveTags container.clusters.listTagBindings container.clusters.update container.componentStatuses.get container.componentStatuses.list container.configMaps.create container.configMaps.delete container.configMaps.get container.configMaps.list container.configMaps.update container.controllerRevisions.create container.controllerRevisions.delete container.controllerRevisions.get container.controllerRevisions.list container.controllerRevisions.update container.cronJobs.create container.cronJobs.delete container.cronJobs.get container.cronJobs.getStatus container.cronJobs.list container.cronJobs.update container.cronJobs.updateStatus container.csiDrivers.create container.csiDrivers.delete container.csiDrivers.get container.csiDrivers.list container.csiDrivers.update container.csiNodeInfos.create container.csiNodeInfos.delete container.csiNodeInfos.get container.csiNodeInfos.list container.csiNodeInfos.update container.csiNodes.create container.csiNodes.delete container.csiNodes.get container.csiNodes.list container.csiNodes.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.getStatus container.customResourceDefinitions.list container.customResourceDefinitions.update container.customResourceDefinitions.updateStatus container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.getStatus container.daemonSets.list container.daemonSets.update container.daemonSets.updateStatus container.deployments.create container.deployments.delete container.deployments.get container.deployments.getScale container.deployments.getStatus container.deployments.list container.deployments.rollback container.deployments.update container.deployments.updateScale container.deployments.updateStatus container.endpointSlices.create container.endpointSlices.delete container.endpointSlices.get container.endpointSlices.list container.endpointSlices.update container.endpoints.create container.endpoints.delete container.endpoints.get container.endpoints.list container.endpoints.update container.events.create container.events.delete container.events.get container.events.list container.events.update container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.frontendConfigs.list container.frontendConfigs.update container.horizontalPodAutoscalers.create container.horizontalPodAutoscalers.delete container.horizontalPodAutoscalers.get container.horizontalPodAutoscalers.getStatus container.horizontalPodAutoscalers.list container.horizontalPodAutoscalers.update container.horizontalPodAutoscalers.updateStatus container.hostServiceAgent.use container.ingresses.create container.ingresses.delete container.ingresses.get container.ingresses.getStatus container.ingresses.list container.ingresses.update container.ingresses.updateStatus container.initializerConfigurations.create container.initializerConfigurations.delete container.initializerConfigurations.get container.initializerConfigurations.list container.initializerConfigurations.update container.jobs.create container.jobs.delete container.jobs.get container.jobs.getStatus container.jobs.list container.jobs.update container.jobs.updateStatus container.leases.create container.leases.delete container.leases.get container.leases.list container.leases.update container.limitRanges.create container.limitRanges.delete container.limitRanges.get container.limitRanges.list container.limitRanges.update container.localSubjectAccessReviews.create container.localSubjectAccessReviews.list container.managedCertificates.create container.managedCertificates.delete container.managedCertificates.get container.managedCertificates.list container.managedCertificates.update container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.get container.mutatingWebhookConfigurations.list container.mutatingWebhookConfigurations.update container.namespaces.create container.namespaces.delete container.namespaces.finalize container.namespaces.get container.namespaces.getStatus container.namespaces.list container.namespaces.update container.namespaces.updateStatus container.networkPolicies.create container.networkPolicies.delete container.networkPolicies.get container.networkPolicies.list container.networkPolicies.update container.nodes.create container.nodes.delete container.nodes.get container.nodes.getStatus container.nodes.list container.nodes.proxy container.nodes.update container.nodes.updateStatus container.operations.get container.operations.list container.persistentVolumeClaims.create container.persistentVolumeClaims.delete container.persistentVolumeClaims.get container.persistentVolumeClaims.getStatus container.persistentVolumeClaims.list container.persistentVolumeClaims.update container.persistentVolumeClaims.updateStatus container.persistentVolumes.create container.persistentVolumes.delete container.persistentVolumes.get container.persistentVolumes.getStatus container.persistentVolumes.list container.persistentVolumes.update container.persistentVolumes.updateStatus container.petSets.create container.petSets.delete container.petSets.get container.petSets.list container.petSets.update container.petSets.updateStatus container.podDisruptionBudgets.create container.podDisruptionBudgets.delete container.podDisruptionBudgets.get container.podDisruptionBudgets.getStatus container.podDisruptionBudgets.list container.podDisruptionBudgets.update container.podDisruptionBudgets.updateStatus container.podPresets.create container.podPresets.delete container.podPresets.get container.podPresets.list container.podPresets.update container.podSecurityPolicies.create container.podSecurityPolicies.delete container.podSecurityPolicies.get container.podSecurityPolicies.list container.podSecurityPolicies.update container.podSecurityPolicies.use container.podTemplates.create container.podTemplates.delete container.podTemplates.get container.podTemplates.list container.podTemplates.update container.pods.attach container.pods.create container.pods.delete container.pods.evict container.pods.exec container.pods.get container.pods.getLogs container.pods.getStatus container.pods.initialize container.pods.list container.pods.portForward container.pods.proxy container.pods.update container.pods.updateStatus container.priorityClasses.create container.priorityClasses.delete container.priorityClasses.get container.priorityClasses.list container.priorityClasses.update container.replicaSets.create container.replicaSets.delete container.replicaSets.get container.replicaSets.getScale container.replicaSets.getStatus container.replicaSets.list container.replicaSets.update container.replicaSets.updateScale container.replicaSets.updateStatus container.replicationControllers.create container.replicationControllers.delete container.replicationControllers.get container.replicationControllers.getScale container.replicationControllers.getStatus container.replicationControllers.list container.replicationControllers.update container.replicationControllers.updateScale container.replicationControllers.updateStatus container.resourceQuotas.create container.resourceQuotas.delete container.resourceQuotas.get container.resourceQuotas.getStatus container.resourceQuotas.list container.resourceQuotas.update container.resourceQuotas.updateStatus container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.create container.roles.delete container.roles.escalate container.roles.get container.roles.list container.roles.update container.runtimeClasses.create container.runtimeClasses.delete container.runtimeClasses.get container.runtimeClasses.list container.runtimeClasses.update container.scheduledJobs.create container.scheduledJobs.delete container.scheduledJobs.get container.scheduledJobs.list container.scheduledJobs.update container.scheduledJobs.updateStatus container.secrets.create container.secrets.delete container.secrets.get container.secrets.list container.secrets.update container.selfSubjectAccessReviews.create container.selfSubjectAccessReviews.list container.selfSubjectRulesReviews.create container.serviceAccounts.create container.serviceAccounts.createToken container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.serviceAccounts.update container.services.create container.services.delete container.services.get container.services.getStatus container.services.list container.services.proxy container.services.update container.services.updateStatus container.statefulSets.create container.statefulSets.delete container.statefulSets.get container.statefulSets.getScale container.statefulSets.getStatus container.statefulSets.list container.statefulSets.update container.statefulSets.updateScale container.statefulSets.updateStatus container.storageClasses.create container.storageClasses.delete container.storageClasses.get container.storageClasses.list container.storageClasses.update container.storageStates.create container.storageStates.delete container.storageStates.get container.storageStates.getStatus container.storageStates.list container.storageStates.update container.storageStates.updateStatus container.storageVersionMigrations.create container.storageVersionMigrations.delete container.storageVersionMigrations.get container.storageVersionMigrations.getStatus container.storageVersionMigrations.list container.storageVersionMigrations.update container.storageVersionMigrations.updateStatus container.subjectAccessReviews.create container.subjectAccessReviews.list container.thirdPartyObjects.create container.thirdPartyObjects.delete container.thirdPartyObjects.get container.thirdPartyObjects.list container.thirdPartyObjects.update container.thirdPartyResources.create container.thirdPartyResources.delete container.thirdPartyResources.get container.thirdPartyResources.list container.thirdPartyResources.update container.tokenReviews.create container.updateInfos.create container.updateInfos.delete container.updateInfos.get container.updateInfos.list container.updateInfos.update container.validatingWebhookConfigurations.create container.validatingWebhookConfigurations.delete container.validatingWebhookConfigurations.get container.validatingWebhookConfigurations.list container.validatingWebhookConfigurations.update container.volumeAttachments.create container.volumeAttachments.delete container.volumeAttachments.get container.volumeAttachments.getStatus container.volumeAttachments.list container.volumeAttachments.update container.volumeAttachments.updateStatus container.volumeSnapshotClasses.create container.volumeSnapshotClasses.delete container.volumeSnapshotClasses.get container.volumeSnapshotClasses.list container.volumeSnapshotClasses.update container.volumeSnapshotContents.create container.volumeSnapshotContents.delete container.volumeSnapshotContents.get container.volumeSnapshotContents.getStatus container.volumeSnapshotContents.list container.volumeSnapshotContents.update container.volumeSnapshotContents.updateStatus container.volumeSnapshots.create container.volumeSnapshots.delete container.volumeSnapshots.get container.volumeSnapshots.getStatus container.volumeSnapshots.list container.volumeSnapshots.update container.volumeSnapshots.updateStatus recommender.containerDiagnosisInsights.* recommender.containerDiagnosisInsights.get recommender.containerDiagnosisInsights.list recommender.containerDiagnosisInsights.update recommender.containerDiagnosisRecommendations.* recommender.containerDiagnosisRecommendations.get recommender.containerDiagnosisRecommendations.list recommender.containerDiagnosisRecommendations.update recommender.locations.* recommender.locations.get recommender.locations.list recommender.networkAnalyzerGkeConnectivityInsights.* recommender.networkAnalyzerGkeConnectivityInsights.get recommender.networkAnalyzerGkeConnectivityInsights.list recommender.networkAnalyzerGkeConnectivityInsights.update recommender.networkAnalyzerGkeIpAddressInsights.* recommender.networkAnalyzerGkeIpAddressInsights.get recommender.networkAnalyzerGkeIpAddressInsights.list recommender.networkAnalyzerGkeIpAddressInsights.update resourcemanager.projects.get resourcemanager.projects.list
Service Account Admin (roles/iam.serviceAccountAdmin) 可创建和管理服务账号。 您可以授予此角色的最低级层资源： 服务账号	iam.serviceAccounts.create iam.serviceAccounts.createTagBinding iam.serviceAccounts.delete iam.serviceAccounts.deleteTagBinding iam.serviceAccounts.disable iam.serviceAccounts.enable iam.serviceAccounts.get iam.serviceAccounts.getIamPolicy iam.serviceAccounts.list iam.serviceAccounts.listEffectiveTags iam.serviceAccounts.listTagBindings iam.serviceAccounts.setIamPolicy iam.serviceAccounts.undelete iam.serviceAccounts.update resourcemanager.projects.get resourcemanager.projects.list

使用用户管理的服务账号运行 AI Platform Pipelines 时所需的角色

Google Kubernetes Engine (GKE) 集群上的 Pod 使用 GKE 集群的服务账号向 Google Cloud 验证身份。为了使 AI Platform Pipelines 更易于设置和使用，由 AI Platform Pipelines 创建的 GKE 集群会使用具有 https://www.googleapis.com/auth/cloud-platform 访问权限范围的默认 Compute Engine 服务账号。此访问权限范围提供对于您在项目中启用的 Google Cloud 资源和 API 的完整访问权限，这可能会为集群中的工作负载提供对 Google Cloud 的过高访问权限。

如需为在 AI Platform Pipelines 集群上运行的工作负载分配精细的权限，请为集群创建一个服务账号，并向该服务账号授予项目以下角色的访问权限：

• Monitoring Viewer：Monitoring Viewer (roles/monitoring.viewer) 角色提供对监控数据和配置的读取权限。
• Monitoring Metric Writer：Monitoring Metric Writer (roles/monitoring.metricWriter) 角色提供写入权限，让您的集群可以写入指标。
• Logs Writer：Logs Writer (roles/logging.logWriter) 角色允许您的集群写入日志条目。
• Storage Object Viewer：如果您计划为存储在 Container Registry 中的流水线创建自定义容器映像，请向 AI Platform Pipelines 集群授予项目中 Storage Object Viewer (roles/storage.objectViewer) 角色的访问权限。

您还必须向服务账号授予对机器学习流水线所用的任何 Google Cloud 资源或 API 的访问权限。

• 将 GKE 集群配置为使用用户管理的服务账号。
• 详细了解 IAM 角色和管理服务账号。

角色	名称	说明	权限
监控查看者 (roles/monitoring.viewer) 提供以只读方式获取和列出与所有监控数据和配置相关的信息的权限。 您可以授予此角色的最低级层资源： 项目	cloudnotifications.activities.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list
Monitoring Metric Writer (roles/monitoring.metricWriter) 提供对指标的只写权限。此角色提供了 Cloud Monitoring 代理和其他发送指标的系统所需的确切权限。 您可以授予此角色的最低级层资源： 项目	monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create
Logs Writer (roles/logging.logWriter) 提供写入日志条目的权限。 您可以授予此角色的最低级层资源： 项目	logging.logEntries.create logging.logEntries.route
Storage Object Viewer (roles/storage.objectViewer) 授予查看对象及其元数据（不包括 ACL）的权限，还提供列出存储桶中对象的权限。 您可以授予此角色的最低级层资源： 存储分区	resourcemanager.projects.get resourcemanager.projects.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list

以用户身份访问 AI Platform Pipelines 所需的角色

要访问 AI Platform Pipelines 集群，必须为每个用户授予 Kubernetes Engine Cluster Viewer (roles/container.clusterViewer) 角色和 Google Kubernetes Engine 集群服务账号的 Service Account User Role。

角色	名称	说明	权限
Kubernetes Engine Cluster Viewer (roles/container.clusterViewer) 提供获取和列出 GKE 集群的权限。	container.clusters.get container.clusters.list resourcemanager.projects.get resourcemanager.projects.list

继续阅读下一部分，了解如何向用户授予 Kubernetes Engine Cluster Viewer 角色和 Service Account User 角色的访问权限。

授予用户对 AI Platform Pipelines 的访问权限

按照以下说明向用户账号授予对 AI Platform Pipelines 集群的访问权限。

1. 在 Google Cloud 控制台中打开 AI Platform Pipelines。

   转到 AI Platform Pipelines

2. 找到您的 AI Platform Pipelines 集群。请记下集群和地区以备后续步骤使用。

   

3. 打开 Cloud Shell 会话。

   打开 Cloud Shell

   Cloud Shell 在 Google Cloud 控制台底部的框架中打开。使用 Cloud Shell 完成此过程的其余部分。

4. 运行以下命令，为 Cloud Storage 存储分区设置默认 Google Cloud 项目 此 Cloud Shell 会话

   gcloud config set project PROJECT_ID
   

   将 PROJECT_ID 替换为您的 Google Cloud 项目 ID。

5. 运行以下命令以查找您的 GKE 集群使用的服务账号。

   gcloud container clusters describe CLUSTER_NAME --zone ZONE \
   --format="flattened(nodePools[].config.serviceAccount)"
   

   替换以下内容：

   • CLUSTER_NAME：GKE 集群的名称。
   • ZONE：创建集群的区域。

   响应可能表明您的集群使用名为 default 的服务账号。此值指 Compute Engine 的默认服务账号。运行以下命令以查找此服务账号的全名。

   gcloud iam service-accounts list \
   --filter "[e-mail]"
   

   详细了解 Compute Engine 默认服务账号。

6. 向您的用户账号授予 GKE 集群服务账号上的 Service Account User 角色。

   gcloud iam service-accounts add-iam-policy-binding \
   SERVICE_ACCOUNT_NAME \
   --member=user:USERNAME \
   --role=roles/iam.serviceAccountUser
   

   替换以下内容：

   • SERVICE_ACCOUNT_NAME：您在上一步中找到的 GKE 集群服务账号的名称。服务账号名称的格式如下所示 *@*.gserviceaccount.com。
   • USERNAME：您在 Google Cloud 上的用户名。

7. 向您的用户账号授予对项目上 GKE Cluster Viewer 角色的访问权限。

   gcloud projects add-iam-policy-binding PROJECT_ID \
   --member user:USERNAME --role roles/container.clusterViewer
   

   替换以下内容：

   • PROJECT_ID：您的 Google Cloud 项目的 ID。
   • USERNAME：您在 Google Cloud 上的用户名。