Attached clusters API access control

To use the GKE attached clusters API, users must have specific Identity and Access Management (IAM) permissions on their Google Cloud account for access to GKE Multi-Cloud resources. GKE attached clusters includes two predefined roles that bundle together two commonly-used sets of permissions:

  • gkemulticloud.viewer (for read-only access) and
  • gkemulticloud.admin(to grant administrative control).

The permissions in these roles are:

gkemulticloud.admin

  • gkemulticloud.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

gkemulticloud.viewer

  • gkemulticloud.attachedClusters.get
  • gkemulticloud.attachedClusters.list
  • gkemulticloud.attachedServerConfigs.get
  • gkemulticloud.attachedClusters.generateInstallManifest
  • gkemulticloud.awsClusters.generateAccessToken
  • gkemulticloud.awsClusters.get
  • gkemulticloud.awsClusters.list
  • gkemulticloud.awsNodePools.get
  • gkemulticloud.awsNodePools.list
  • gkemulticloud.awsServerConfigs.get
  • gkemulticloud.azureClients.get
  • gkemulticloud.azureClients.list
  • gkemulticloud.azureClusters.generateAccessToken
  • gkemulticloud.azureClusters.get
  • gkemulticloud.azureClusters.list
  • gkemulticloud.azureNodePools.get
  • gkemulticloud.azureNodePools.list
  • gkemulticloud.azureServerConfigs.get
  • gkemulticloud.operations.get
  • gkemulticloud.operations.list
  • gkemulticloud.operations.wait
  • resourcemanager.projects.get
  • resourcemanager.projects.list

To learn about granting and revoking these permissions, see Manage access to projects, folders, and organizations.