gcloud container hub memberships generate-gateway-rbac

NAME

gcloud container hub memberships generate-gateway-rbac - generate RBAC policy files for connected clusters by the user

SYNOPSIS

gcloud container hub memberships generate-gateway-rbac (--anthos-support     | --groups=GROUPS     | --users=USERS) [--apply] [--context=CONTEXT] [--kubeconfig=KUBECONFIG] [--membership=MEMBERSHIP] [--rbac-output-file=RBAC_OUTPUT_FILE] [--revoke] [--role=ROLE] [GCLOUD_WIDE_FLAG …]

DESCRIPTION

gcloud container hub memberships generate-gateway-rbac generates RBAC policies to be used by Connect Gateway API.

Upon success, this command will write the output RBAC policy to the designated local file in dry run mode.

Override RBAC policy: Y to override previous RBAC policy, N to stop. If overriding the --role, Y will clean up the previous RBAC policy and then apply the new one.

EXAMPLES

The current implementation supports multiple modes:

Dry run mode to generate the RBAC policy file, and write to local directory:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],[e-mail] --role=clusterrole/cluster-admin --rbac-output-file=./rbac.yaml

Dry run mode to generate the RBAC policy, and print on screen:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],[e-mail] --role=clusterrole/cluster-admin

Anthos support mode, generate the RBAC policy file with read-only permission for TSE/Eng to debug customers' clusters:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --anthos-support

Apply mode, generate the RBAC policy and apply it to the specified cluster:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],[e-mail] --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

Revoke mode, revoke the RBAC policy for the specified users:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],[e-mail] --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --revoke

The role to be granted to the users can either be cluster-scoped or namespace-scoped. To grant a namespace-scoped role to the users in dry run mode, run:

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],[e-mail] --role=role/mynamespace/namespace-reader

The users provided can be using a Google identity (only email) or using external identity providers (starting with "principal://iam.googleapis.com"):

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --users=[e-mail],principal://iam.googleapis.com/locations/global/workforcePools/pool/subject/user --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

The groups can be provided as a Google identity (only email) or an external identity (starting with "principalSet://iam.googleapis.com"):

gcloud container hub memberships generate-gateway-rbac --membership=my-cluster --groups=[e-mail],principalSet://iam.googleapis.com/locations/global/workforcePools/pool/group/ExampleGroup --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

REQUIRED FLAGS

Exactly one of these must be specified:

--anthos-support

If specified, this command will generate RBAC policy file for anthos support.

--groups=GROUPS

Group email address or third-party IAM group principal.

--users=USERS

User's email address, service account email address, or third-party IAM subject principal.

OPTIONAL FLAGS

--apply

If specified, this command will generate RBAC policy and apply to the specified cluster.

--context=CONTEXT

The cluster context as it appears in the kubeconfig file. You can get this value from the command line by running command: kubectl config current-context.

--kubeconfig=KUBECONFIG

The kubeconfig file containing an entry for the cluster. Defaults to $KUBECONFIG if it is set in the environment, otherwise defaults to $HOME/.kube/config.

--membership=MEMBERSHIP

Membership name to assign RBAC policy with.

--rbac-output-file=RBAC_OUTPUT_FILE

If specified, this command will execute in dry run mode and write to the file specified with this flag: the generated RBAC policy will not be applied to Kubernetes clusters,instead it will be written to the designated local file.

--revoke

If specified, this command will revoke the RBAC policy for the specified users.

--role=ROLE

Namespace scoped role or cluster role.

GCLOUD WIDE FLAGS

These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES

These variants are also available:

gcloud alpha container hub memberships generate-gateway-rbac

gcloud beta container hub memberships generate-gateway-rbac