gcloud alpha container hub scopes add-app-operator-binding - add project-level and fleet scope-level IAM bindings and create a fleet scope RBAC role binding for an app operator principal

gcloud alpha container hub scopes add-app-operator-bindingSCOPE(--custom-role=CUSTOM_ROLE    |--role=ROLE)(--group=GROUP    |--user=USER)[--labels=[KEY=VALUE,…]][GCLOUD_WIDE_FLAG …]

This command sets up the different permissions required for an app operator,including usage of fleet scopes, connect gateway, logging, and metrics. Theauthoritative list for adding the permissions is the existing RBAC role bindingsunder the specified scope.

This command can fail for the following reasons:

• The scope specified does not exist.
• The user does not have access to the specified scope.
• The principal specified already has another binding for the scope.

gcloudalphacontainerhubscopesadd-app-operator-bindingSCOPE--role=view--group=people@google.com--project=PROJECT_ID

• adds IAM policy binding: roles/gkehub.scopeViewer onSCOPE
• adds IAM policy binding: roles/gkehub.scopeViewerProjectLevel onPROJECT_ID
• adds IAM policy binding: roles/logging.viewAccessor onPROJECT_IDwith condition where bucket corresponds toSCOPE
• creates fleet scope RBAC role binding: roleview with a random IDfor grouppeople@google.com.

---

The following command:

gcloudalphacontainerhubscopesadd-app-operator-bindingSCOPE--role=edit--user=person@google.com--project=PROJECT_ID

• adds IAM policy binding: roles/gkehub.scopeEditor onSCOPE
• adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel onPROJECT_ID
• adds IAM policy binding: roles/logging.viewAccessor onPROJECT_IDwith condition where bucket corresponds toSCOPE
• creates fleet scope RBAC role binding: roleedit with a random IDfor userperson@google.com.

---

The following command:

gcloudalphacontainerhubscopesadd-app-operator-bindingSCOPE--role=admin--user=person@google.com--project=PROJECT_ID

• adds IAM policy binding: roles/gkehub.scopeAdmin onSCOPE
• adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel onPROJECT_ID
• adds IAM policy binding: roles/logging.viewAccessor onPROJECT_IDwith condition where bucket corresponds toSCOPE
• creates fleet scope RBAC role binding: roleadmin with a random IDfor userperson@google.com.

---

The following command:

gcloudalphacontainerhubscopesadd-app-operator-bindingSCOPE--custom-role=my-custom-role--user=person@google.com--project=PROJECT_ID

• adds IAM policy binding: roles/gkehub.scopeViewer onSCOPE
• adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel onPROJECT_ID
• adds IAM policy binding: roles/logging.viewAccessor onPROJECT_IDwith condition where bucket corresponds toSCOPE
• creates fleet scope RBAC role binding: rolemy-custom-role with arandom ID for userperson@google.com.

For any tailored IAM permissions required when using a custom role, the user orgroup can separately be granted additional IAM permissions on the project.

Scope resource - The group of arguments defining the Fleet Scope. Thisrepresents a Cloud resource. (NOTE) Some attributes are not given arguments inthis group but can be set in other ways.

To set theproject attribute:

• provide the argumentSCOPE on the command line with a fullyspecified name;
• provide the argument--project on the command line;
• set the propertycore/project.

To set thelocation attribute:

• provide the argumentSCOPE on the command line with a fullyspecified name;
• global is the only supported location.

This must be specified.

SCOPE

ID of the scope or fully qualified identifier for the scope.

To set thescope attribute:

• provide the argumentSCOPE on the command line.

Exactly one of these must be specified:

--custom-role=CUSTOM_ROLE

Custom role to assign to principal.

--role=ROLE

Predefined role to assign to principal (admin, edit, view).ROLE must be one of:admin,edit,view.

Exactly one of these must be specified:

--group=GROUP

Group for the role binding.

--user=USER

User for the role binding.

--labels=[KEY=VALUE,…]

List of label KEY=VALUE pairs to add.

Keys must start with a lowercase character and contain only hyphens(-), underscores (_), lowercase characters, andnumbers. Values must contain only hyphens (-), underscores(_), lowercase characters, and numbers.

Run$gcloud help for details.