Stay organized with collections
Save and categorize content based on your preferences.
Before you perform tasks on virtual machines (VM) in
Google Distributed Cloud (GDC) air-gapped appliance, you must have the proper identity and access
(IAM) roles and permissions.
GDC air-gapped appliance offers Identity and Access Management (IAM) for
granular access to specific GDC air-gapped appliance resources and prevents
unwanted access to other resources. IAM operates on the security
principle of least privilege and provides control over who, or identity, has
which permissions, or roles, and to which resources. You must have the necessary
roles and permissions assigned to you before you can work with virtual machines (VMs).
Before you begin
To use gdcloud CLI commands, complete the required steps from the
gdcloud command-line interface (CLI)
sections. All commands for Google Distributed Cloud air-gapped appliance use the
gdcloud or kubectl CLI, and require an operating system (OS) environment.
Record the path to the generated file. The following is an example of the
path to record: /tmp/admin-kubeconfig-with-user-identity.yaml.
Use the path to replace MANAGEMENT_API_SERVER in
these instructions.
About IAM
GDC air-gapped appliance offers Identity and Access Management (IAM) for
granular access to specific GDC air-gapped appliance resources and prevents
unwanted access to other resources. IAM operates on the security
principle of least privilege and provides control over who has permission
to given resources using IAM roles and permissions.
Read the IAM documentation in
Sign in, which provides
instructions for signing in to the GDC console or the
gdcloud CLI and using kubectl to access your workloads.
Predefined roles to VM resources
To create VMs and VM disks in a project, request the appropriate permissions
from your Project IAM Admin for a given project. To manage virtual machines,
your Project IAM Admin can assign you the following predefined roles:
Project VirtualMachine Admin: Manages VMs in the project namespace.
Project VirtualMachine Image Admin: Manages VM images in the project
namespace.
For a list of all predefined roles for Application Operators (AO), see
Role descriptions.
The following are predefined common roles for VMs. For details on common roles,
see
Common roles.
VM type viewer: has read access to predefined VM types.
Public image viewer: has read access to images GDC air-gapped appliance
provides.
Replace the variables by using the following definitions.
Variable
Replacement
MANAGEMENT_API_SERVER
The Management API server kubeconfig path
from gdcloud auth login
PROJECT
to create VM images
If the output is yes, you have permissions to create a VM in the
project PROJECT.
If the output is no, you don't have permissions. Contact your Project
IAM Admin and request assignment to the Project VirtualMachine Admin
(project-vm-admin) role.
Optional: Verify whether users have access to project-level VM images and whether they can create and use
VirtualMachineImage resources at the project level:
Replace the variables by using the following definitions.
Variable
Replacement
MANAGEMENT_API_SERVER
The Management API server kubeconfig path
PROJECT
The project name where VM images are created
If the output is yes, the user has permissions to access custom VM images
in the project PROJECT.
If the output is no, you don't have permissions. Contact your Project
IAM Admin role and request assignment to the Project VirtualMachine Image
Admin (project-vm-image-admin) role.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eBefore performing tasks on virtual machines (VMs) in Google Distributed Cloud (GDC) air-gapped appliance, users must have the necessary Identity and Access Management (IAM) roles and permissions assigned.\u003c/p\u003e\n"],["\u003cp\u003eGDC air-gapped appliance uses IAM to provide granular access to resources based on the principle of least privilege, ensuring that users only have the permissions they need.\u003c/p\u003e\n"],["\u003cp\u003eProject IAM Admins can assign predefined roles such as "Project VirtualMachine Admin" or "Project VirtualMachine Image Admin" to manage VMs and VM images within a specific project.\u003c/p\u003e\n"],["\u003cp\u003eTo verify VM creation permissions, you can use the \u003ccode\u003ekubectl\u003c/code\u003e command with the \u003ccode\u003eauth can-i\u003c/code\u003e check, replacing variables with the \u003ccode\u003eadmin cluster kubeconfig\u003c/code\u003e path and the respective project name.\u003c/p\u003e\n"],["\u003cp\u003eUsers can also verify access to project-level VM images using \u003ccode\u003ekubectl\u003c/code\u003e, which will let them know whether they have the required permissions to view or create those images.\u003c/p\u003e\n"]]],[],null,["# IAM permissions preparation\n\nBefore you perform tasks on virtual machines (VM) in\nGoogle Distributed Cloud (GDC) air-gapped appliance, you must have the proper identity and access\n(IAM) roles and permissions.\n\nGDC air-gapped appliance offers Identity and Access Management (IAM) for\ngranular access to specific GDC air-gapped appliance resources and prevents\nunwanted access to other resources. IAM operates on the security\nprinciple of least privilege and provides control over *who* , or identity, has\n*which permissions*, or roles, and to which resources. You must have the necessary\nroles and permissions assigned to you before you can work with virtual machines (VMs).\n\nBefore you begin\n----------------\n\nTo use gdcloud CLI commands, complete the required steps from the\n[gdcloud command-line interface (CLI)](/distributed-cloud/hosted/docs/latest/appliance/resources/gdcloud-overview)\nsections. All commands for Google Distributed Cloud air-gapped appliance use the\n`gdcloud` or `kubectl` CLI, and require an operating system (OS) environment.\n\n### Get the kubeconfig file paths\n\n1. Run [`gdcloud auth login`](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/sign-in#sign-in)\n to the **Management API server**.\n\n 1. Record the path to the generated file. The following is an example of the\n path to record: \n\n `/tmp/admin-kubeconfig-with-user-identity.yaml`.\n\n 2. Use the path to replace \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e in\n these instructions.\n\nAbout IAM\n---------\n\nGDC air-gapped appliance offers Identity and Access Management (IAM) for\ngranular access to specific GDC air-gapped appliance resources and prevents\nunwanted access to other resources. IAM operates on the security\nprinciple of least privilege and provides control over who has permission\nto given resources using IAM roles and permissions.\n\nRead the IAM documentation in\n[Sign in](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/sign-in), which provides\ninstructions for signing in to the GDC console or the\ngdcloud CLI and using `kubectl` to access your workloads.\n\n### Predefined roles to VM resources\n\nTo create VMs and VM disks in a project, request the appropriate permissions\nfrom your Project IAM Admin for a given project. To manage virtual machines,\nyour Project IAM Admin can assign you the following predefined roles:\n\n- **Project VirtualMachine Admin**: Manages VMs in the project namespace.\n- **Project VirtualMachine Image Admin**: Manages VM images in the project namespace.\n\nFor a list of all predefined roles for Application Operators (AO), see\n[Role descriptions](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/role-descriptions).\n\nThe following are predefined common roles for VMs. For details on common roles,\nsee\n[Common roles](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/role-descriptions#common_roles).\n\n- **VM type viewer**: has read access to predefined VM types.\n- **Public image viewer**: has read access to images GDC air-gapped appliance provides.\n\nTo grant or receive access to VM resources, see\n[Grant access to project resources](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/role-bindings).\n\nVerify user access to VM resources\n----------------------------------\n\n1. [Log in](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/iam/sign-in#cli) as the\n user requesting or verifying permissions.\n\n2. Verify whether you, or the user, can create virtual machines:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i create virtualmachines.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the variables by using the following definitions.\n\n If the output is `yes`, you have permissions to create a VM in the\n project \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e. \n\n If the output is `no`, you don't have permissions. Contact your Project\n IAM Admin and request assignment to the Project VirtualMachine Admin\n (`project-vm-admin`) role.\n3. Optional: Verify whether users have access to project-level VM images and whether they can create and use\n `VirtualMachineImage` resources at the project level:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i get virtualmachineimages.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i create virtualmachineimageimports.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the variables by using the following definitions.\n\n - If the output is `yes`, the user has permissions to access custom VM images in the project \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e.\n - If the output is `no`, you don't have permissions. Contact your Project IAM Admin role and request assignment to the Project VirtualMachine Image Admin (`project-vm-image-admin`) role."]]
