Role definitions for projects

The tables of this section describe different predefined roles and their permissions. The tables contain the following columns:

  • Name: The name of a role displayed in the user interface (UI).
  • Kubernetes resource name: The name of the corresponding Kubernetes custom resource.
  • Level: The specification of whether this role is scoped by the organization or a project.
  • Type: The type of this role. For example, some possible values are Role, ProjectRole, ClusterRole, or ProjectClusterRole.
  • Binding type: The type of binding that you must apply to this role.
  • Management API server or Kubernetes cluster permissions: The permissions that this role has for the Management API server or the Kubernetes cluster. For example, some possible values are read, write, read and write, or not applicable (N/A).
  • Escalates to: The specification of whether this role escalates to other roles or not.

AO persona, predefined identity and access roles

AO persona
Name Kubernetes resource name Initial admin Level Type
Project IAM Admin project-iam-admin True Project Role
AI OCR Developer ai-ocr-developer False Project Role
AI Platform Viewer ai-platform-viewer False Project Role
AI Speech Developer ai-speech-developer False Project Role
AI Translation Developer ai-translation-developer False Project Role
Artifact Management Admin artifact-management-admin False Project Role
Artifact Management Editor artifact-management-editor False Project Role
Certificate Authority Service Admin certificate-authority-service-admin False Project Role
Certificate Service Admin certificate-service-admin False Project Role
Dashboard Editor dashboard-editor False Project Role
Dashboard Viewer dashboard-viewer False Project Role
Harbor Instance Admin harbor-instance-admin False Project Role
Harbor Instance Viewer harbor-instance-viewer False Project Role
Harbor Project Creator harbor-project-creator False Project Role
K8s Network Policy Admin k8s-networkpolicy-admin False Project ProjectRole
Load Balancer Admin load-balancer-admin False Project ProjectRole
LoggingRule Creator loggingrule-creator False Project Role
LoggingRule Editor loggingrule-editor False Project Role
LoggingRule Viewer loggingrule-viewer False Project Role
LoggingTarget Creator loggingtarget-creator False Project Role
LoggingTarget Editor loggingtarget-editor False Project Role
LoggingTarget Viewer loggingtarget-viewer False Project Role
MonitoringRule Editor monitoringrule-editor False Project Role
MonitoringRule Viewer monitoringrule-viewer False Project Role
MonitoringTarget Editor monitoringtarget-editor False Project Role
MonitoringTarget Viewer monitoringtarget-viewer False Project Role
Namespace Admin namespace-admin False Project ProjectRole
NAT Viewer nat-viewer False Project ProjectRole
ObservabilityPipeline Editor observabilitypipeline-editor False Project Role
ObservabilityPipeline Viewer observabilitypipeline-viewer False Project Role
Project Bucket Admin project-bucket-admin False Project Role
Project Bucket Object Admin project-bucket-object-admin False Project Role
Project Bucket Object Viewer project-bucket-object-viewer False Project Role
Project Cortex Alertmanager Editor project-cortex-alertmanager-editor False Project Role
Project Cortex Alertmanager Viewer project-cortex-alertmanager-viewer False Project Role
Project Cortex Prometheus Viewer project-cortex-prometheus-viewer False Project Role
Project Grafana Viewer project-grafana-viewer False Project Role
Project NetworkPolicy Admin project-networkpolicy-admin False Project Role
Project Viewer project-viewer False Project Role
Project VirtualMachine Admin project-vm-admin False Project Role
Project VirtualMachine Image Admin project-vm-image-admin False Project Role
Secret Admin secret-admin False Project Role
Secret Viewer secret-viewer False Project Role
Service Configuration Admin service-configuration-admin False Project Role
Service Configuration Viewer service-configuration-viewer False Project Role
Workbench Notebooks Admin workbench-notebooks-admin False Project Role
Volume Replication Admin app-volume-replication-admin False Cluster Role
Workbench Notebooks Viewer workbench-notebooks-viewer False Project Role
Workload Viewer workload-viewer False Project Role

AO persona, predefined identity, and access roles

AO persona
Name Binding type Management API server permissions Kubernetes cluster permissions Escalates to
Project IAM Admin RoleBinding
  • RoleBinding, ClusterRoleBinding, Role, ClusterRole, ProjectRole, ProjectClusterRole, ProjectRoleBinding, and ProjectClusterRoleBinding: Create, read, update, delete, and bind
  • ProjectServiceAccount: Create, read, update, and delete
  • List project namespace
 N/A All other AO roles
AI OCR Developer RoleBinding OCR resources: Read and write N/A N/A
AI Speech Developer RoleBinding Speech resources: Read and write N/A N/A
AI Translation Developer RoleBinding Translation resources: Read and write N/A N/A
Artifact Management Admin RoleBinding HarborProjects: Admin, create, read, write, delete, and view N/A N/A
Artifact Management Editor RoleBinding HarborProjects: Read, write, and view N/A N/A
Certificate Authority Service Admin RoleBinding Certificate authorities and certificate requests: Get, list, watch, update, create, delete, and patch N/A N/A
Certificate Service Admin RoleBinding Certificates and certificate issuers: Get, list, watch, update, create, delete, and patch N/A N/A
Dashboard Editor RoleBinding Dashboard custom resources: Get, read, create, update, delete, and patch N/A N/A
Dashboard Viewer RoleBinding Dashboard: Get and read N/A N/A
Harbor Instance Admin RoleBinding Harbor instances: Create, read, update, delete, and patch N/A N/A
Harbor Instance Viewer RoleBinding Harbor instances: Read N/A N/A
Harbor Project Creator RoleBinding Harbor instance projects: Create, get, and watch N/A N/A
K8s NetworkPolicy Admin ProjectRoleBinding N/A NetworkPolicy resources: Create, read, get, update, delete, and patch N/A
Load Balancer Admin RoleBinding N/A
  • Backend: Get, watch, list, create, patch, update, and delete
  • HealthCheck: Get, watch, list, create, patch, update, and delete
  • BackendService: Get, watch, list, create, patch, update, and delete
  • ForwardingRuleExternal: Get, watch, list, create, patch, update, and delete
  • ForwardingRuleInternal: Get, watch, list, create, patch, update, and delete
 N/A
LoggingRule Creator RoleBinding LoggingRule custom resources: Create, read, update, delete, and patch N/A N/A
LoggingRule Editor RoleBinding LoggingRule custom resources: Create, read, update, delete, and patch N/A N/A
LoggingRule Viewer RoleBinding LoggingRule custom resources: Read N/A N/A
LoggingTarget Creator RoleBinding LoggingTarget custom resources: Create, read, update, delete, and patch N/A N/A
LoggingTarget Editor RoleBinding LoggingTarget custom resources: Create, read, update, delete, and patch N/A N/A
LoggingTarget Viewer RoleBinding LoggingTarget custom resources: Read N/A N/A
MonitoringRule Editor RoleBinding MonitoringRule custom resources: Create, read, update, delete, and patch N/A N/A
MonitoringRule Viewer RoleBinding MonitoringRule custom resources: Read N/A N/A
MonitoringTarget Editor RoleBinding MonitoringTarget custom resources: Create, read, update, delete, and patch N/A N/A
MonitoringTarget Viewer RoleBinding MonitoringTarget custom resources: Read N/A N/A
Namespace Admin ProjectRoleBinding N/A All resources: Read and write access in the project namespace N/A
NAT Viewer ProjectRoleBinding N/A Deployments: Get and read N/A
ObservabilityPipeline Editor RoleBinding ObservabilityPipeline resources: Get, read, create, update, delete, and patch N/A N/A
ObservabilityPipeline Viewer RoleBinding ObservabilityPipeline resources: Get and read N/A N/A
Project Bucket Admin RoleBinding Bucket: Read and write in the project namespace N/A N/A
Project Bucket Object Admin RoleBinding
  • Bucket: Read
  • Objects: Read and write
 N/A N/A
Project Bucket Object Viewer RoleBinding Bucket and objects: Read N/A N/A
Project Cortex Alertmanager Editor RoleBinding Cortex system and Cortex Alertmanager: Read and write N/A N/A
Project Cortex Alertmanager Viewer RoleBinding Cortex system and Cortex Alertmanager: Read N/A N/A
Project Cortex Prometheus Viewer RoleBinding Cortex system and Cortex Prometheus: Read N/A N/A
Project Grafana Viewer RoleBinding Grafana system and Grafana: Read and write N/A N/A
Project NetworkPolicy Admin RoleBinding Project network policies: Read and write in the project namespace N/A N/A
Project Viewer RoleBinding All resources in the project namespace: Read N/A N/A
Project VirtualMachine Admin RoleBinding
  • Virtual machines, disks, access requests, external access, backup requests, backups, restore requests, delete backup requests, restores, and password reset requests: Read, create, update, and delete
  • Virtual machine restart: Put
  • Virtual machine images, backup plans, and backup plan templates: Read
 N/A N/A
Project VirtualMachine Image Admin RoleBinding
  • VM images: Read
  • VM image imports: Read and write
  • Buckets: Create
  • "vm-images-bucket" Bucket: Read and write
 N/A N/A
Secret Admin RoleBinding Kubernetes secrets: Read, create, update, delete, and patch N/A N/A
Secret Viewer RoleBinding Kubernetes secrets: Read N/A N/A
Service Configuration Admin RoleBinding ServiceConfigurations: Read and write N/A N/A
Service Configuration Viewer RoleBinding ServiceConfigurations: Read N/A N/A
Volume Replication Admin ClusterRoleBinding Volume failovers, volume relationship replicas: Create, get, list, watch, delete N/A N/A
Workbench Notebooks Admin RoleBinding N/A
  • Notebook custom resources (CR) in the project namespace: Create, read, update, and delete
  • ClusterInfo objects: Read
 N/A
Workbench Notebooks Viewer RoleBinding N/A
  • Notebook custom resources (CR) in the project namespace: Read
 N/A
Workload Viewer ProjectRoleBinding N/A
  • Pod custom resources in the project namespace: Read
  • Deployment custom resources in the project namespace: Read
 N/A

Common predefined identity and access roles

Common roles
Name Kubernetes resource name Initial admin Level Type
AI Platform Viewer ai-platform-viewer False Project Role
DNS Suffix Viewer dnssuffix-viewer False Organization Role
Flow Log Admin flowlog-admin False Organization ClusterRole
Flow Log Viewer flowlog-viewer False Project ClusterRole
Project Discovery Viewer projectdiscovery-viewer False Project ClusterRole
Public Image Viewer public-image-viewer False Organization Role
System Artifact Registry anthos-creds secret Monitor sar-anthos-creds-secret-monitor False Organization Role
System Artifact Registry gpc-system secret Monitor sar-gpc-system-secret-monitor False Organization Role
System Artifact Registry harbor-system secret Monitor sar-harbor-system-secret-monitor False Organization Role
Virtual Machine Type Viewer virtualmachinetype-viewer False Organization OrganizationRole
VM Type Viewer vmtype-viewer False Organization Role

Common predefined identity and access roles

Common roles
Name Binding type Admin cluster permissions Kubernetes cluster permissions Escalates to
AI Platform Viewer RoleBinding Pre-trained services: Read N/A N/A
DNS Suffix Viewer ClusterRoleBinding DNS suffix config maps: Read N/A N/A
Flow Log Admin ClusterRoleBinding Flow log resources: Get and read Flow log resources: Get and read N/A
Flow Log Viewer ClusterRoleBinding Flow log resources: Create, get, read, patch, update, and delete Flow log resources: Create, get, read, patch, update, and delete N/A
Project Discovery Viewer ClusterRoleBinding Projects: Read N/A N/A
Public Image Viewer RoleBinding VM images: Read N/A N/A
System Artifact Registry anthos-creds secret Monitor RoleBinding anthos-creds secrets: Get and read anthos-creds secrets: Get and read N/A
System Artifact Registry gpc-system secret Monitor RoleBinding gpc-system secrets: Get and read gpc-system secrets: Get and read N/A
System Artifact Registry harbor-system secret Monitor RoleBinding harbor-system secrets: Get and read harbor-system secrets: Get and read N/A
Virtual Machine Type Viewer OrganizationRoleBinding N/A VM types: Read N/A
VM Type Viewer ClusterRoleBinding VM types: Read N/A N/A