# Example file name:# rolebinding-object-admin-all-buckets.yamlapiVersion:rbac.authorization.k8s.io/v1kind:RoleBindingmetadata:namespace:NAMESPACE_NAMEname:readwrite-all-bucketsroleRef:kind:Rolename:project-bucket-object-adminapiGroup:rbac.authorization.k8s.iosubjects:-kind:ServiceAccountnamespace:NAMESPACE_NAMEname:SA_NAME-kind:Usernamespace:NAMESPACE_NAMEname:bob@example.comapiGroup:rbac.authorization.k8s.io# Could be bob or bob@example.com based on your organization settings.
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis page explains how to manage access to Google Distributed Cloud (GDC) air-gapped storage buckets, which requires a project namespace to manage bucket resources in the Management API server.\u003c/p\u003e\n"],["\u003cp\u003eBucket access can be granted to users or service accounts by creating RoleBindings with predefined Roles like \u003ccode\u003eproject-bucket-object-viewer\u003c/code\u003e, \u003ccode\u003eproject-bucket-object-admin\u003c/code\u003e, or \u003ccode\u003eproject-bucket-admin\u003c/code\u003e in the Management API server.\u003c/p\u003e\n"],["\u003cp\u003eThere are three main predefined roles, each with a different level of permission: \u003ccode\u003eproject-bucket-object-viewer\u003c/code\u003e for reading, \u003ccode\u003eproject-bucket-object-admin\u003c/code\u003e for read and write operations, and \u003ccode\u003eproject-bucket-admin\u003c/code\u003e for full bucket management, including objects within those buckets.\u003c/p\u003e\n"],["\u003cp\u003eOnce access is granted, credentials are created in a Secret, which can be found in the \u003ccode\u003eobject-storage-access-keys\u003c/code\u003e namespace for users, and in the project namespace for service accounts.\u003c/p\u003e\n"],["\u003cp\u003eTo obtain access credentials, users will use \u003ccode\u003ekubectl\u003c/code\u003e commands to find the corresponding secret name, get the secret contents, decode them, and then use the resultant information to configure the \u003ccode\u003egdcloud\u003c/code\u003e CLI.\u003c/p\u003e\n"]]],[],null,["# Grant and obtain storage bucket access for projects\n\nThis page guides you through how to manage access to storage buckets within Google Distributed Cloud (GDC) air-gapped projects, so the right people have the right permissions. It covers the prerequisites and steps for obtaining and granting user and service account access using role bindings and predefined roles. This information lets you effectively control access to your storage resources and maintain both security and operational efficiency.\n\nThis page is for audiences such as IT administrators within the infrastructure operator group or developers within the application operator group who manage access settings for storage buckets in GDC air-gapped environments. For more information, see [Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/project-management) to work with buckets and objects.\n\nGrant bucket access\n-------------------\n\nYou can provide bucket access to other users or service accounts by creating\nand applying RoleBindings with predefined Roles in the Management API server.\n\n### Predefined roles\n\n- **project-bucket-object-viewer:** This lets a user list all buckets in the\n project, list objects in those buckets, and read objects and object metadata.\n It does not let you write operations on objects. For example: uploading,\n overwriting, deleting. Has read-only on dual-zone buckets within the organization and its projects, as well as read-only on the objects in those buckets.\n\n- **project-bucket-object-admin:** This lets a user list all buckets in the\n project, and write and read operations on objects. For example: uploading,\n overwriting, deleting. Has read-only on dual-zone buckets within the organization and its projects, as well as read-write on the objects in those buckets.\n\n- **project-bucket-admin:** This lets users manage all buckets in the given\n namespace, as well as all the objects in those buckets. Has read-only on dual-zone buckets within the organization and its projects, as well as read-write on the objects in those buckets.\n\nTo see a complete list of the permissions granted for the preceding Roles,\nsee the [preset Role permissions](#preset_role_permissions) section.\n\nAsk your Project IAM Admin to grant you permissions to create\nRoleBindings. The following is an example of creating a RoleBinding for granting access to a\nuser and a service account:\n\n1. Create a YAML file on your system, such as `rolebinding-object-admin-all-buckets.yaml`.\n\n # Example file name:\n # rolebinding-object-admin-all-buckets.yaml\n apiVersion: rbac.authorization.k8s.io/v1\n kind: RoleBinding\n metadata:\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: readwrite-all-buckets\n roleRef:\n kind: Role\n name: project-bucket-object-admin\n apiGroup: rbac.authorization.k8s.io\n subjects:\n - kind: ServiceAccount\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eSA_NAME\u003c/span\u003e\u003c/var\u003e\n - kind: User\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n name: bob@example.com\n apiGroup: rbac.authorization.k8s.io\n # Could be bob or bob@example.com based on your organization settings.\n\n2. Apply the YAML file:\n\n kubectl apply \\\n -f rolebinding-object-admin-all-buckets.yaml\n\nObtain bucket access credentials\n--------------------------------\n\nOnce you grant access to a bucket, it creates the access credentials in a Secret.\n\nThe format of the secret name is `object-storage-key-`\u003cvar translate=\"no\"\u003eSTORAGE_CLASS\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eSUBJECT_TYPE\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eSUBJECT_HASH\u003c/var\u003e.\n\n- Values for \u003cvar translate=\"no\"\u003eSTORAGE_CLASS\u003c/var\u003e are:\n - `std` for the `Standard` storage class.\n- Values for \u003cvar translate=\"no\"\u003eSUBJECT_TYPE\u003c/var\u003e are:\n - `user` for User.\n - `sa` for ServiceAccount.\n- \u003cvar translate=\"no\"\u003eSUBJECT_HASH\u003c/var\u003e is the base32-encoded SHA256 hash of the subject name.\n\nAs an example, the user `bob@foo.com` has two secrets named:\n\n1. `object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja`\n\n### Obtain user access\n\nFor a user subject, the Secret is in the `object-storage-access-keys`\nnamespace in the Management API server.\n\n1. Run the following command to find the secret name:\n\n kubectl auth can-i --list --namespace object-storage-access-keys | grep object-storage-key-\n\n You receive an output similar to the following: \n\n secrets [] [object-storage-key-nl-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja,object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja] [get]\n\n2. Get the contents of the corresponding secret to access buckets in the `Standard` storage class:\n\n kubectl get -o yaml --namespace object-storage-access-keys secret object-storage-key-std-user-oy6jdqd6bxfoqcecn2ozv6utepr5bgh355vfku7th5pmejqubdja\n\n You receive an output similar to the following: \n\n data:\n access-key-id: MEhYM08wWUMySjcyMkVKTFBKRU8=\n create-time: MjAyMi0wNy0yMiAwMTowODo1OS40MTQyMTE3MDMgKzAwMDAgVVRDIG09KzE5OTAuMzQ3OTE2MTc3\n secret-access-key: Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==\n\n3. Decode the access key ID and secret:\n\n echo \"MEhYM08wWUMySjcyMkVKTFBKRU8=\" | base64 -d \\\n && echo \\\n && echo \"Ump0MVRleVN4SmhCSVJhbmlnVDAwbTJZc0IvRlJVendqR0JuYVhiVA==\" | base64 -d\n\n You receive an output similar to the following: \n\n 0HX3O0YC2J722EJLPJEO\n Rjt1TeySxJhBIRanigT00m2YsB/FRUzwjGBnaXbT\n\n4. Follow the section, [Configure the gdcloud CLI](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/install-configure-storage-cli#gdcloud-storage-configure), with the resulting\n information.\n\n### Obtain service account access\n\n| **Note:** Users are not allowed to run workloads, which run as service accounts, in the Management API server where the service accounts' access key Secrets were initially created. Users won't be able to grant workloads access to those Secrets in the Management API server. Those Secrets will be propagated to the Project namespaces in the appropriate user clusters, where users will be able to access them (if they have the appropriate RBAC Roles within that Project).\n\nFor a service account (SA) subject, find the secret name from the user cluster.\n\n1. For standard storage class, run the following command to get the secret name:\n\n kubectl get -n=\u003cPROJECT-NAME\u003e serviceaccount \u003cSA-NAME\u003e -o json | jq -r '.secrets[] | select(.name | test(\"object-storage-key-std\"))'\n\n2. Then, you can manually look through the listed secret names or use `grep` to find `object-storage-key-(std|nl)`. For the latter option, run the following:\n\n kubectl get -n=\u003cPROJECT-NAME\u003e serviceaccount \u003cSA-NAME\u003e -o=jsonpath='{.secrets}{\"\\n\"}' | grep object-storage-key-(std|nl)\n\n3. You can reference the Secret in your pod as [environment variables](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables) or [files](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod).\n\n### Preset role permissions\n\nNote that predefined roles are also available in the global API server for administrative and operational access to dual-zone buckets.\n\n#### project-bucket-object-viewer permissions\n\nThis role grants permissions to get and list objects and objects' metadata in\nthe bucket.\n\nA list of all object storage permissions the project-bucket-object-viewer verb\ngrants are the following:\n\n- **Bucket API permissions**:\n\n 1. get\n 2. list\n 3. watch\n- **S3 object storage permissions**:\n\n 1. GetObject\n 2. GetObjectAcl\n 3. GetObjectLegalHold\n 4. GetObjectRetention\n 5. GetObjectTagging\n 6. GetObjectVersion\n 7. GetObjectVersionTagging\n 8. ListBucket\n 9. ListBucketVersions\n 10. ListBucketMultipartUploads\n 11. ListMultipartUploadParts\n\n#### project-bucket-object-admin permissions\n\nThis role grants permissions to put and delete objects, and object versions and\ntags in the bucket. Additionally, it also grants all permissions in the\n`project-bucket-object-viewer`.\n\nA list of all additional object storage permissions the Role grants are the\nfollowing:\n\n- **S3 Object storage permissions**:\n\n 1. AbortMultipartUpload\n 2. DeleteObject\n 3. DeleteObjectTagging\n 4. DeleteObjectVersion\n 5. DeleteObjectVersionTagging\n 6. PutObject\n 7. PutObjectTagging\n 8. PutObjectVersionTagging\n 9. PutOverwriteObject\n 10. RestoreObject\n\n#### project-bucket-admin permissions\n\nThis role grants permissions to create, update, or delete Bucket resources in\nthe project namespace. Additionally, it also grants all permissions in\n`project-bucket-object-admin`.\n\nA list of additional permissions the Role grants are the following:\n\n- **Bucket API permissions**:\n\n 1. Create\n 2. Update\n 3. Delete"]]
