Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Sebelum melakukan tugas di virtual machine (VM) dalam
Google Distributed Cloud (GDC) yang terisolasi, Anda harus memiliki peran dan izin
(IAM) identitas dan akses yang tepat.
Sebelum memulai
Untuk menggunakan perintah gdcloud CLI, selesaikan langkah-langkah yang diperlukan dari bagian
antarmuka command line (CLI) gdcloud. Semua perintah untuk penggunaan Google Distributed Cloud air-gapped menggunakan CLI gdcloud atau kubectl, dan memerlukan lingkungan sistem operasi (OS).
Mendapatkan jalur file kubeconfig
Untuk menjalankan perintah terhadap server Management API, pastikan Anda memiliki resource berikut:
Login dan buat file kubeconfig untuk server Management API jika Anda belum memilikinya.
Gunakan jalur ke file kubeconfig server Management API untuk menggantikan
MANAGEMENT_API_SERVER dalam petunjuk ini.
Tentang IAM
Distributed Cloud menawarkan Identity and Access Management (IAM) untuk
akses terperinci ke resource Distributed Cloud tertentu dan mencegah
akses yang tidak diinginkan ke resource lain. IAM beroperasi berdasarkan prinsip keamanan hak istimewa terendah dan memberikan kontrol atas siapa yang memiliki izin untuk mengakses resource tertentu menggunakan peran dan izin IAM.
Baca dokumentasi IAM di bagian
Login, yang memberikan
petunjuk untuk login ke konsol GDC atau
gdcloud CLI dan menggunakan kubectl untuk mengakses beban kerja Anda.
Peran bawaan untuk resource VM
Untuk membuat VM dan disk VM dalam project, minta izin yang sesuai dari Admin IAM Project Anda untuk project tertentu. Semua peran VM harus terikat ke namespace project tempat VM berada. Untuk mengelola virtual machine, Admin IAM Project Anda dapat memberi Anda peran bawaan berikut:
Project VirtualMachine Adminproject-vm-admin: Mengelola VM di
namespace project.
Project VirtualMachine Image Adminproject-vm-image-admin: Mengelola image VM di namespace project.
Untuk mengetahui daftar semua peran bawaan untuk Operator Aplikasi (AO), lihat
Deskripsi peran.
Berikut adalah peran umum bawaan untuk VM. Untuk mengetahui detail tentang peran umum, lihat Peran umum.
Pelihat jenis VMvm-type-viewer: memiliki akses baca ke jenis VM bawaan.
Penampil gambar publikpublic-image-viewer: memiliki akses baca ke gambar yang disediakan GDC.
Ganti variabel dengan menggunakan definisi berikut.
Variabel
Penggantian
MANAGEMENT_API_SERVER
File kubeconfig sistem
dari gdcloud auth login.
PROJECT
Nama project untuk membuat image VM.
Jika outputnya adalah yes, Anda memiliki izin untuk membuat VM di project PROJECT.
Jika outputnya adalah no, berarti Anda tidak memiliki izin. Hubungi Admin IAM Project Anda dan minta penetapan ke peran Project VirtualMachine Admin (project-vm-admin) di namespace project tempat VM berada.
Opsional: Verifikasi apakah pengguna memiliki akses ke image VM tingkat project. Misalnya, jalankan perintah berikut untuk memverifikasi apakah mereka dapat membuat dan menggunakan resource VirtualMachineImage di tingkat project:
Ganti variabel dengan menggunakan definisi berikut.
Variabel
Penggantian
MANAGEMENT_API_SERVER
File kubeconfig server Management API.
PROJECT
Nama project tempat image VM dibuat.
Jika outputnya adalah yes, pengguna memiliki izin untuk mengakses image VM kustom di project PROJECT.
Jika outputnya adalah no, berarti Anda tidak memiliki izin. Hubungi peran Project IAM Admin Anda dan minta penetapan ke peran Project VirtualMachine Image Admin (project-vm-image-admin) di namespace project tempat VM berada.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eProper Identity and Access Management (IAM) roles and permissions are required before performing tasks on virtual machines (VMs) in Google Distributed Cloud (GDC) air-gapped.\u003c/p\u003e\n"],["\u003cp\u003eTo manage virtual machines in a project, a Project IAM Admin can assign the "Project VirtualMachine Admin" role, while managing VM images require the "Project VirtualMachine Image Admin" role.\u003c/p\u003e\n"],["\u003cp\u003eUsers can verify their permissions to create VMs or access VM images within a specific project using \u003ccode\u003ekubectl\u003c/code\u003e commands and checking for a "yes" or "no" output.\u003c/p\u003e\n"],["\u003cp\u003eGDC offers IAM for granular access control to resources, ensuring that only authorized users can access specific resources, adhering to the principle of least privilege.\u003c/p\u003e\n"]]],[],null,["# IAM permissions preparation\n\nBefore you perform tasks on virtual machines (VM) in\nGoogle Distributed Cloud (GDC) air-gapped, you must have the proper identity and access\n(IAM) roles and permissions.\n\nBefore you begin\n----------------\n\nTo use gdcloud CLI commands, complete the required steps from the\n[gdcloud command-line interface (CLI)](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-overview)\nsections. All commands for Google Distributed Cloud air-gapped use the\n`gdcloud` or `kubectl` CLI, and require an operating system (OS) environment.\n\n### Get the kubeconfig file path\n\nTo run commands against the Management API server, ensure you have the following\nresources:\n\n1. [Sign in and generate](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/sign-in#cli) the\n kubeconfig file for the Management API server if you don't have one.\n\n2. Use the path to the kubeconfig file of the Management API server to replace\n \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e in these instructions.\n\nAbout IAM\n---------\n\nDistributed Cloud offers Identity and Access Management (IAM) for\ngranular access to specific Distributed Cloud resources and prevents\nunwanted access to other resources. IAM operates on the security\nprinciple of least privilege and provides control over who has permission\nto given resources using IAM roles and permissions.\n\nRead the IAM documentation in\n[Sign in](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/sign-in), which provides\ninstructions for signing in to the GDC console or the\ngdcloud CLI and using `kubectl` to access your workloads.\n\n### Predefined roles to VM resources\n\nTo create VMs and VM disks in a project, request the appropriate permissions\nfrom your Project IAM Admin for a given project. All VM roles must bind to the\nnamespace of the project where the VM resides. To manage virtual machines,\nyour Project IAM Admin can assign you the following predefined roles:\n\n- **Project VirtualMachine Admin** `project-vm-admin`: Manages VMs in the project namespace.\n- **Project VirtualMachine Image Admin** `project-vm-image-admin`: Manages VM images in the project namespace.\n\nFor a list of all predefined roles for Application Operators (AO), see\n[Role descriptions](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/role-descriptions).\n\nThe following are predefined common roles for VMs. For details on common roles,\nsee\n[Common roles](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/role-descriptions#common_roles).\n\n- **VM type viewer** `vm-type-viewer`: has read access to predefined VM types.\n- **Public image viewer** `public-image-viewer`: has read access to images GDC provides.\n\nTo grant or receive access to VM resources, see\n[Grant access to project resources](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/role-bindings).\n\nVerify user access to VM resources\n----------------------------------\n\n1. [Log in](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/sign-in#cli) as the\n user requesting or verifying permissions.\n\n2. Verify whether you, or the user, can create virtual machines:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i create virtualmachines.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the variables by using the following definitions.\n\n - If the output is `yes`, you have permissions to create a VM in the project \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e.\n - If the output is `no`, you don't have permissions. Contact your Project IAM Admin and request assignment to the Project VirtualMachine Admin (`project-vm-admin`) role in the namespace of the project where the VM resides.\n3. Optional: Verify whether users have access to project-level VM images. For\n example, run the following commands to verify if they can create and use\n `VirtualMachineImage` resources at the project level:\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i get virtualmachineimages.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e auth can-i create virtualmachineimageimports.virtualmachine.gdc.goog -n \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Replace the variables by using the following definitions.\n\n - If the output is `yes`, the user has permissions to access custom VM images in the project \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e.\n - If the output is `no`, you don't have permissions. Contact your Project IAM Admin role and request assignment to the Project VirtualMachine Image Admin (`project-vm-image-admin`) role in the namespace of the project where the VM resides."]]
