gcloud beta container hub memberships generate-gateway-rbac

gcloud beta container hub memberships generate-gateway-rbac - generate RBAC policy files for connected clusters by the user

gcloud beta container hub memberships generate-gateway-rbac (--anthos-support     | --groups=GROUPS     | --users=USERS) [--apply] [--context=CONTEXT] [--kubeconfig=KUBECONFIG] [--membership=MEMBERSHIP] [--rbac-output-file=RBAC_OUTPUT_FILE] [--revoke] [--role=ROLE] [GCLOUD_WIDE_FLAG …]

Upon success, this command will write the output RBAC policy to the designated local file in dry run mode.

Override RBAC policy: Y to override previous RBAC policy, N to stop. If overriding the --role, Y will clean up the previous RBAC policy and then apply the new one.

Dry run mode to generate the RBAC policy file, and write to local directory:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,test-acct@test-project.iam.gserviceaccount.com --role=clusterrole/cluster-admin --rbac-output-file=./rbac.yaml

Dry run mode to generate the RBAC policy, and print on screen:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,test-acct@test-project.iam.gserviceaccount.com --role=clusterrole/cluster-admin

Anthos support mode, generate the RBAC policy file with read-only permission for TSE/Eng to debug customers' clusters:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --anthos-support

Apply mode, generate the RBAC policy and apply it to the specified cluster:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,test-acct@test-project.iam.gserviceaccount.com --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

Revoke mode, revoke the RBAC policy for the specified users:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,test-acct@test-project.iam.gserviceaccount.com --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --revoke

The role to be granted to the users can either be cluster-scoped or namespace-scoped. To grant a namespace-scoped role to the users in dry run mode, run:

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,test-acct@test-project.iam.gserviceaccount.com --role=role/mynamespace/namespace-reader

The users provided can be using a Google identity (only email) or using external identity providers (starting with "principal://iam.googleapis.com"):

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --users=foo@example.com,principal://iam.googleapis.com/locations/global/workforcePools/pool/subject/user --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

The groups can be provided as a Google identity (only email) or an external identity (starting with "principalSet://iam.googleapis.com"):

gcloud beta container hub memberships generate-gateway-rbac --membership=my-cluster --groups=group@example.com,principalSet://iam.googleapis.com/locations/global/workforcePools/pool/group/ExampleGroup --role=clusterrole/cluster-admin --context=my-cluster-context --kubeconfig=/home/user/custom_kubeconfig --apply

Exactly one of these must be specified:

--anthos-support

If specified, this command will generate RBAC policy file for anthos support.

--groups=GROUPS

Group email address or third-party IAM group principal.

--users=USERS

User's email address, service account email address, or third-party IAM subject principal.

--apply

If specified, this command will generate RBAC policy and apply to the specified cluster.

--context=CONTEXT

The cluster context as it appears in the kubeconfig file. You can get this value from the command line by running command: kubectl config current-context.

--kubeconfig=KUBECONFIG

The kubeconfig file containing an entry for the cluster. Defaults to $KUBECONFIG if it is set in the environment, otherwise defaults to $HOME/.kube/config.

--membership=MEMBERSHIP

Membership name to assign RBAC policy with.

--rbac-output-file=RBAC_OUTPUT_FILE

If specified, this command will execute in dry run mode and write to the file specified with this flag: the generated RBAC policy will not be applied to Kubernetes clusters,instead it will be written to the designated local file.

--revoke

If specified, this command will revoke the RBAC policy for the specified users.

--role=ROLE

Namespace scoped role or cluster role.

Run $ gcloud help for details.