Some parts of the Google Kubernetes Engine (GKE) API and the Kubernetes API require additional permissions before you can use them. Those permissions are described in the following tables. For instructions on managing permissions, see Granting, Changing, and Revoking Access to Resources.
Google Kubernetes Engine API permissions
The information in this table is relevant to the GKE API.
| Method | Required Permission(s) | 
|---|---|
| projects.locations.clusters.create | container.clusters.createon the containing Cloud project, andiam.serviceAccounts.actAson the specified service account. | 
| projects.locations.clusters.delete | container.clusters.deleteon the requested cluster. | 
| projects.locations.clusters.get | container.clusters.geton the requested cluster, andcontainer.clusters.getCredentialsto see the cluster's credentials. | 
| projects.locations.clusters.list | container.clusters.liston the requested Cloud project, andcontainer.clusters.getCredentialsto see each cluster's credentials. | 
| projects.locations.clusters.update | container.clusters.updateon the requested cluster. | 
| projects.locations.clusters.nodePools.create | container.clusters.updateon the requested cluster. | 
| projects.locations.clusters.nodePools.delete | container.clusters.updateon the requested cluster. | 
| projects.locations.clusters.nodePools.get | container.clusters.geton the requested cluster. | 
| projects.locations.clusters.nodePools.list | container.clusters.geton the requested cluster. | 
| projects.locations.operations.get | container.operations.geton the requested operations. | 
| projects.locations.operations.list | container.operations.liston the requested Cloud project. | 
| POST /apis/{path_to_custom_resource} | container.thirdPartyObjects.create | 
| DELETE /apis/{path_to_custom_resource}/{name} | container.thirdPartyObjects.delete | 
| DELETE /apis/{path_to_custom_resource} | container.thirdPartyObjects.delete | 
| GET /apis/{path_to_custom_resource}/{name} | container.thirdPartyObjects.get | 
| GET /apis/{path_to_custom_resource} | container.thirdPartyObjects.list | 
| PATCH /apis/{path_to_custom_resource} | container.thirdPartyObjects.update | 
| PUT /apis/{path_to_custom_resource} | container.thirdPartyObjects.update | 
| {other_verb} /apis/{path_to_custom_resource} | container.thirdPartyObjects.update | 
| Bind to a ClusterRole | container.clusterRoles.bind | 
| Bind to a Role | container.roles.bind | 
Kubernetes API permissions
The information in this table is relevant to the Kubernetes core API.