gcloud beta container hub scopes remove-app-operator-binding

gcloud beta container hub scopes remove-app-operator-binding - remove project-level and fleet scope-level IAM bindings and delete a fleet scope RBAC role binding for an app operator principal

gcloud beta container hub scopes remove-app-operator-binding SCOPE (--group=GROUP     | --user=USER) [GCLOUD_WIDE_FLAG …]

This command unsets the different permissions required for an app operator, including usage of fleet scopes, connect gateway, logging, and metrics. The authoritative list for removing the permissions is the existing RBAC role bindings under the specified scope.

This command can fail for the following reasons:

• The scope specified does not exist.
• The user does not have access to the specified scope.
• The principal specified does not any binding for the scope.
• The principal specified has bindings with different roles for the scope.

gcloud beta container hub scopes remove-app-operator-binding SCOPE --group=people@google.com --project=PROJECT_ID

assuming the group already has the view role:

• removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
• removes IAM policy binding: roles/gkehub.scopeViewerProjectLevel from PROJECT_ID if the group does not have the view role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor from PROJECT_ID condition where bucket corresponds to SCOPE
• deletes existing fleet scope RBAC role binding: role view for group people@google.com.

---

The following command:

gcloud beta container hub scopes remove-app-operator-binding SCOPE --user=person@google.com --project=PROJECT_ID

assuming the user already has the edit role:

• removes IAM policy binding: roles/gkehub.scopeEditor from SCOPE
• removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from PROJECT_ID if the user does not have the edit/admin role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor from PROJECT_ID condition where bucket corresponds to SCOPE
• deletes existing fleet scope RBAC role binding: role edit for user person@google.com.

---

The following command:

gcloud beta container hub scopes remove-app-operator-binding SCOPE --role=admin --user=person@google.com --project=PROJECT_ID

assuming the user already has the admin role:

• removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
• removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from PROJECT_ID if the user does not have the edit/admin role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor from PROJECT_ID condition where bucket corresponds to SCOPE
• deletes existing fleet scope RBAC role binding: role admin for user person@google.com.

Scope resource - The group of arguments defining the Fleet Scope. This represents a Cloud resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways.

To set the project attribute:

• provide the argument SCOPE on the command line with a fully specified name;
• provide the argument --project on the command line;
• set the property core/project.

To set the location attribute:

• provide the argument SCOPE on the command line with a fully specified name;
• global is the only supported location.

This must be specified.

SCOPE

ID of the scope or fully qualified identifier for the scope.

To set the scope attribute:

• provide the argument SCOPE on the command line.

Exactly one of these must be specified:

--group=GROUP

Group for the role binding.

--user=USER

User for the role binding.

Run $ gcloud help for details.