IAM roles and permissions

Autopilot Standard

This page describes how to grant the Backup for GKE service permissions for a Google Cloud project, backups, or restores.

Predefined roles

Backup for GKE has the following predefined roles:

Role	Title	Description	Lowest resource
`gkebackup.admin`	Backup for GKE Admin	Full read-write access to all Backup for GKE resources	Project
`gkebackup.backupAdmin`	Backup for GKE Backup Admin	Creates and manages backup plans and backups. Can delegate manual backup creation to Delegated Backup Admins.	Project
`gkebackup.delegatedBackupAdmin`	Backup for GKE Delegated Backup Admin	Creates and manages backups within a backup plan.	BackupPlan
`gkebackup.viewer`	Backup for GKE Viewer	Read-only access to all Backup for GKE resources	Project
`gkebackup.restoreAdmin`	Backup for GKE Restore Admin	Creates and manages restore plans and restores. Can delegate restore creation to Delegated Restore Admins.	Project
`gkebackup.delegatedRestoreAdmin`	Backup for GKE Delegated Restore Admin	Creates and manages restores within a restore plan.	RestorePlan

Set project-level permissions

You can grant Identity and Access Management permissions for an entire Google Cloud project to an account in the IAM page of the Google Cloud console or by using the Google Cloud CLI. Adding permissions at the project level grants the IAM permissions to an account for the following roles:

Backup for GKE Admin
Backup for GKE Backup Admin
Backup for GKE Viewer
Backup for GKE Restore Admin

gcloud

To set permissions, run the following command:

gcloud projects add-iam-policy-binding PROJECT_ID\
    --role roles/ROLE_ID \
    --member PRINCIPAL

Replace the following:

PROJECT_ID: the ID of your Google Cloud project.
ROLE_ID: the type of role, for example gkebackup.backupAdmin.
PRINCIPAL: An identifier for the principal, which usually has the following form: member-type:id. For example, user:my-user@example.com.

Console

Perform the following tasks in the Google Cloud console:

Go to your project's IAM page.

Go to IAM
Click the Grant access button below the toolbar.
In the New principals box, enter the email for the account that you want to add.
Select a role in the drop-down list, for example Backup for GKE Admin.
Click Save.