This page shows you how to grant and obtain access for Google Distributed Cloud (GDC) air-gapped storage buckets.
Before you begin
A project namespace manages bucket resources in the org admin cluster. You must have a project to work with buckets and objects.
Grant bucket access
You can provide bucket access to other users or service accounts by creating and applying RoleBindings with predefined Roles in the org admin cluster.
Predefined roles
project-bucket-object-viewer: This lets a user list all buckets in the project, list objects in those buckets, and read objects and object metadata. It does not let you write operations on objects. For example: uploading, overwriting, deleting.
project-bucket-object-admin: This lets a user list all buckets in the project, and write and read operations on objects. For example: uploading, overwriting, deleting.
project-bucket-admin: This lets users manage all buckets in the given namespace, as well as all the objects in those buckets.
To see a complete list of the permissions granted for the preceding Roles, see the preset Role permissions section.
Ask your Project IAM Admin to grant you permissions to create RoleBindings. The following is an example of creating a RoleBinding for granting access to a user and a service account:
Create a YAML file on your system, such as
rolebinding-object-admin-all-buckets.yaml
.# Example file name: # rolebinding-object-admin-all-buckets.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: namespace: NAMESPACE_NAME name: readwrite-all-buckets roleRef: kind: Role name: project-bucket-object-admin apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount namespace: NAMESPACE_NAME name: SA_NAME - kind: User namespace: NAMESPACE_NAME name: bob@example.com apiGroup: rbac.authorization.k8s.io # Could be bob or bob@example.com based on your organization settings.
Apply the YAML file:
kubectl apply \ -f rolebinding-object-admin-all-buckets.yaml
Obtain bucket access credentials
Once you grant access to a bucket, it creates the access credentials in a Secret.
The format of the secret name is object-storage-key-STORAGE_CLASS-SUBJECT_TYPE-SUBJECT_HASH
.
- Values for
STORAGE_CLASS
are:std
for theStandard
storage class.
- Values for
SUBJECT_TYPE
are:user
for User.sa
for ServiceAccount.
SUBJECT_HASH
is the base32-encoded SHA256 hash of the subject name.
As an example, the user bob@foo.com
has has a secret named:
object-storage-key-std-user-l74gbpyrsbmwy4mivocr3nur6dzrnhcfhe3otyplul42i732aama
Obtain user access
For a user subject, the Secret is in the object-storage-access-keys
namespace in the Organization cluster.
Run the following command to find the secret name:
kubectl get --namespace object-storage-access-keys secrets -o=jsonpath='{.items[?(@.metadata.annotations.object\.gdc\.goog/subject=="bob@example.com")].metadata.name}'
You receive an output similar to the following:
object-storage-key-std-user-l74gbpyrsbmwy4mivocr3nur6dzrnhcfhe3otyplul42i732aama
Get the contents of the corresponding Secret:
kubectl get -o yaml --namespace object-storage-access-keys secret object-storage-key-std-user-l74gbpyrsbmwy4mivocr3nur6dzrnhcfhe3otyplul42i732aama
You receive an output similar to the following:
data: access-key-id: MEhYM08wWUMySjcyMkVKTFBKRU8= create-time: MjAyMi0wNy0yMiAwMTowODo1OS40MTQyMTE3MDMgKzAwMDAgVVRDIG09KzE5OTAuMzQ3OTE2MTc3 secret-access-key: Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==
Decode the access key ID and secret:
echo "MEhYM08wWUMySjcyMkVKTFBKRU8=" | base64 -d \ && echo \ && echo "Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==" | base64 -d
You receive an output similar to the following:
0HX3O0YC2J722EJLPJEO Rjt1TeySxJhBIRanigT00m2YsB/FRUzwjGBnaXbT
Follow the section, Configure the gdcloud CLI, with the resulting information.
Obtain service account access
For a service account (SA) subject, the Secret is created in the same namespace as the service account. To find the name, run:
kubectl get --namespace NAMESPACE_NAME secrets -o=jsonpath='{.items[?(@.metadata.annotations.object\.gdc\.goog/subject=="SA_NAME")].metadata.name}'
You receive an output similar to the following:
object-storage-key-std-sa-mng3olp3vsynhswzasowzu3jgzct2ert72pjp6wsbzqhdwckwzbq
You can reference the Secret in your pod as environment variables or files.
Preset role permissions
project-bucket-object-viewer permissions
This role grants permissions to get and list objects and objects' metadata in the bucket.
A list of all object storage permissions the project-bucket-object-viewer verb grants are the following:
Bucket API permissions:
- get
- list
- watch
S3 object storage permissions:
- GetObject
- GetObjectAcl
- GetObjectLegalHold
- GetObjectRetention
- GetObjectTagging
- GetObjectVersion
- GetObjectVersionTagging
- ListBucket
- ListBucketVersions
- ListBucketMultipartUploads
- ListMultipartUploadParts
project-bucket-object-admin permissions
This role grants permissions to put and delete objects, and object versions and
tags in the bucket. Additionally, it also grants all permissions in the
project-bucket-object-viewer
.
A list of all additional object storage permissions the Role grants are the following:
S3 Object storage permissions:
- AbortMultipartUpload
- DeleteObject
- DeleteObjectTagging
- DeleteObjectVersion
- DeleteObjectVersionTagging
- PutObject
- PutObjectTagging
- PutObjectVersionTagging
- PutOverwriteObject
- RestoreObject
project-bucket-admin permissions
This role grants permissions to create, update, or delete Bucket resources in
the project namespace. Additionally, it also grants all permissions in
project-bucket-object-admin
.
A list of additional permissions the Role grants are the following:
Bucket API permissions:
- Create
- Update
- Delete