apiVersion:rbac.authorization.k8s.io/v1kind:RoleBindingmetadata:namespace:NAMESPACE_NAMEname:readwrite-all-bucketsroleRef:kind:Rolename:project-bucket-object-adminapiGroup:rbac.authorization.k8s.iosubjects:-kind:ServiceAccountnamespace:NAMESPACE_NAMEname:SA_NAME-kind:Usernamespace:NAMESPACE_NAMEname:bob@example.com# Could be bob or bob@example.com based on your organization settings.apiGroup:rbac.authorization.k8s.io```
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis guide outlines how to grant and obtain access to Google Distributed Cloud (GDC) air-gapped appliance storage buckets within a project namespace.\u003c/p\u003e\n"],["\u003cp\u003eBucket access is granted by creating and applying RoleBindings with predefined Roles like \u003ccode\u003eproject-bucket-object-viewer\u003c/code\u003e, \u003ccode\u003eproject-bucket-object-admin\u003c/code\u003e, or \u003ccode\u003eproject-bucket-admin\u003c/code\u003e, each providing different levels of read/write permissions.\u003c/p\u003e\n"],["\u003cp\u003eAccess credentials for users and service accounts are stored in Secrets, with the secret name formatted as \u003ccode\u003eobject-storage-key-SUBJECT_TYPE-SUBJECT_HASH\u003c/code\u003e, and found in the \u003ccode\u003eobject-storage-access-keys\u003c/code\u003e namespace for users or the service account's namespace.\u003c/p\u003e\n"],["\u003cp\u003eTo get bucket access, you will need to find the secret name using \u003ccode\u003ekubectl auth can-i --list --namespace object-storage-access-keys\u003c/code\u003e then get the content using \u003ccode\u003ekubectl get -o yaml --namespace object-storage-access-keys secret object-storage-key-...\u003c/code\u003e and decoding it.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eproject-bucket-object-viewer\u003c/code\u003e role enables listing and reading bucket objects, while \u003ccode\u003eproject-bucket-object-admin\u003c/code\u003e allows for read and write operations on objects, and \u003ccode\u003eproject-bucket-admin\u003c/code\u003e allows full management of the buckets as well as all the object permissions.\u003c/p\u003e\n"]]],[],null,["# Grant and obtain storage bucket access\n\nThis page guides you through how to manage access to storage buckets within Google Distributed Cloud (GDC) air-gapped appliance projects, so the right people have the right permissions. It covers the prerequisites and steps for obtaining and granting user and service account access using role bindings and predefined roles. This information lets you effectively control access to your storage resources and maintain both security and operational efficiency.\n\nThis page is for audiences such as IT administrators within the infrastructure operator group or developers within the application operator group who manage access settings for storage buckets in GDC air-gapped environments.\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/appliance/platform/pa-user/create-a-project) to work\nwith buckets and objects.\n\nGrant bucket access\n-------------------\n\nYou can provide bucket access to other users or service accounts by creating\nand applying RoleBindings with predefined Roles.\n\n### Predefined roles\n\n- **project-bucket-object-viewer:** This role lets a user list all buckets in the\n project, list objects in those buckets, and read objects and object metadata.\n This role does not let you write operations on objects, such as uploading,\n overwriting, or deleting.\n\n- **project-bucket-object-admin:** This role lets a user list all buckets in the\n project, and write and read operations on objects, such as uploading,\n overwriting, or deleting.\n\n- **project-bucket-admin:** This role lets users manage all buckets in the given\n namespace, as well as all the objects in those buckets.\n\nTo see a complete list of the permissions granted for these roles,\nsee the [preset role permissions](#preset_role_permissions) section.\n\nTo get the permissions that you need to create project role bindings,\nask your Project IAM Admin to grant you the Project IAM Admin\n(`project-iam-admin`) role.\n\nThe following is an example of creating a `RoleBinding` for granting access to a\nuser and a service account:\n\n1. Create a YAML file on your system, such as `rolebinding-object-admin-all-buckets.yaml`.\n\n apiVersion: rbac.authorization.k8s.io/v1\n kind: RoleBinding\n metadata:\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: readwrite-all-buckets\n roleRef:\n kind: Role\n name: project-bucket-object-admin\n apiGroup: rbac.authorization.k8s.io\n subjects:\n - kind: ServiceAccount\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eSA_NAME\u003c/span\u003e\u003c/var\u003e\n - kind: User\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: bob@example.com # Could be bob or bob@example.com based on your organization settings.\n apiGroup: rbac.authorization.k8s.io\n ```\n\n2. Apply the YAML file:\n\n kubectl apply \\\n -f rolebinding-object-admin-all-buckets.yaml\n\nGet bucket access credentials\n-----------------------------\n\nWhen you grant access to a bucket, the access credentials are created in a\nSecret.\n\nThe format of the secret name is `object-storage-key-std-`\u003cvar translate=\"no\"\u003eSUBJECT_TYPE\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eSUBJECT_HASH\u003c/var\u003e.\n\n- Values for \u003cvar translate=\"no\"\u003eSUBJECT_TYPE\u003c/var\u003e are the following:\n - `user`: the user.\n - `sa`: the `ServiceAccount`.\n- \u003cvar translate=\"no\"\u003eSUBJECT_HASH\u003c/var\u003e is the base32-encoded SHA256 hash of the subject name.\n\nAs an example, the user `bob@foo.com` has the secret named: \n\n object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja\n\n### Access the user secret\n\nFor a user subject, the Secret is in the `object-storage-access-keys`\nnamespace in the Management API server.\n\n1. Find the secret name:\n\n kubectl auth can-i --list --namespace object-storage-access-keys | grep object-storage-key-std\n\n You receive an output similar to the following: \n\n secrets [] [object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja,object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja] [get]\n\n2. Get the contents of the corresponding Secret to access buckets:\n\n kubectl get -o yaml --namespace object-storage-access-keys secret\n object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja\n\n You receive an output similar to the following: \n\n data:\n access-key-id: MEhYM08wWUMySjcyMkVKTFBKRU8=\n create-time: MjAyMi0wNy0yMiAwMTowODo1OS40MTQyMTE3MDMgKzAwMDAgVVRDIG09KzE5OTAuMzQ3OTE2MTc3\n secret-access-key: Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==\n\n3. Decode the access key ID and secret:\n\n echo \"MEhYM08wWUMySjcyMkVKTFBKRU8=\" | base64 -d \\\n && echo \\\n && echo \"Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==\" | base64 -d\n\n You receive an output similar to the following: \n\n 0HX3O0YC2J722EJLPJEO\n Rjt1TeySxJhBIRanigT00m2YsB/FRUzwjGBnaXbT\n\n4. Follow the section, [Configure s3cmd](/distributed-cloud/hosted/docs/latest/appliance/platform/pa-user/install-configure-storage-cli#s3cmd_configure), with the resulting\n information.\n\n### Access the service account secret\n\nFor a service account (SA) subject, the Secret is created in the same namespace\nas the service account. To find the name, run: \n\n kubectl get --namespace \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e secrets -o=jsonpath=\n '{.items[?(@.metadata.annotations.object\\.gdc\\.goog/subject==\"\u003cvar translate=\"no\"\u003eSA_NAME\u003c/var\u003e\")].metadata.name}'\n\nYou receive an output similar to the following: \n\n object-storage-key-std-sa-mng3olp3vsynhswzasowzu3jgzct2ert72pjp6wsbzqhdwckwzbq\n\nYou can reference the Secret in your pod as environment variables (\u003chttps://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables\u003e) or files (\u003chttps://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod\u003e).\n\nPreset role permissions\n-----------------------\n\nWhen working with object storage, you might need to request the following roles.\n\n### project-bucket-object-viewer permissions\n\nThis role grants permissions to get and list objects and objects' metadata in\nthe bucket.\n\nThe `project-bucket-object-viewer` role has the following permissions:\n\n- **Bucket API permissions**:\n\n 1. Get\n 2. List\n 3. Watch\n- **S3 object storage permissions**:\n\n 1. `GetObject`\n 2. `GetObjectAcl`\n 3. `GetObjectVersion`\n 4. `ListBucket`\n 5. `ListBucketVersions`\n 6. `ListBucketMultipartUploads`\n 7. `ListMultipartUploadParts`\n\n### project-bucket-object-admin permissions\n\nThis role grants permissions to put and delete objects, object versions, and\ntags in the bucket. Additionally, it also grants all permissions in the\n`project-bucket-object-viewer`.\n\nThe `project-bucket-object-admin` role has the following object storage\npermissions:\n\n- **S3 Object storage permissions**:\n\n 1. `AbortMultipartUpload`\n 2. `DeleteObject`\n 3. `PutObject`\n\n### project-bucket-admin permissions\n\nThis role grants permissions to create, update, or delete `Bucket` resources in\nthe project namespace. Additionally, it also grants all permissions in\n`project-bucket-object-admin`.\n\nThe `project-bucket-object-admin` role has the following permissions:\n\n- **Bucket API permissions**:\n\n 1. Create\n 2. Update\n 3. Delete"]]
