gcloud beta container hub scopes remove-app-operator-binding - remove project-level and fleet scope-level IAM bindings and delete a fleet scope RBAC role binding for an app operator principal

gcloud beta container hub scopes remove-app-operator-bindingSCOPE(--group=GROUP    |--user=USER)[GCLOUD_WIDE_FLAG …]

This command unsets the different permissions required for an app operator,including usage of fleet scopes, connect gateway, logging, and metrics. Theauthoritative list for removing the permissions is the existing RBAC rolebindings under the specified scope.

This command can fail for the following reasons:

• The scope specified does not exist.
• The user does not have access to the specified scope.
• The principal specified does not any binding for the scope.
• The principal specified has bindings with different roles for the scope.

gcloudbetacontainerhubscopesremove-app-operator-bindingSCOPE--group=people@google.com--project=PROJECT_ID

assuming the group already has theview role:

• removes IAM policy binding: roles/gkehub.scopeViewer fromSCOPE
• removes IAM policy binding: roles/gkehub.scopeViewerProjectLevel fromPROJECT_ID if the group does not have theview rolefor any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor fromPROJECT_ID condition where bucket corresponds toSCOPE
• deletes existing fleet scope RBAC role binding: roleview for grouppeople@google.com.

---

The following command:

gcloudbetacontainerhubscopesremove-app-operator-bindingSCOPE--user=person@google.com--project=PROJECT_ID

assuming the user already has theedit role:

• removes IAM policy binding: roles/gkehub.scopeEditor fromSCOPE
• removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel fromPROJECT_ID if the user does not have theedit/admin role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor fromPROJECT_ID condition where bucket corresponds toSCOPE
• deletes existing fleet scope RBAC role binding: roleedit for userperson@google.com.

---

The following command:

gcloudbetacontainerhubscopesremove-app-operator-bindingSCOPE--user=person@google.com--project=PROJECT_ID

assuming the user already has a custom role:

• removes IAM policy binding: roles/gkehub.scopeViewer fromSCOPE
• removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel fromPROJECT_ID if the user does not have theedit/admin role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor fromPROJECT_ID condition where bucket corresponds toSCOPE
• deletes existing fleet scope RBAC role binding: roleadmin for userperson@google.com.

---

The following command:

gcloudbetacontainerhubscopesremove-app-operator-bindingSCOPE--user=person@google.com--project=PROJECT_ID

assuming the user already has theadmin role:

• removes IAM policy binding: roles/gkehub.scopeAdmin fromSCOPE
• removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel fromPROJECT_ID if the user does not have theedit/admin role for any other scope under the project
• removes IAM policy binding: roles/logging.viewAccessor fromPROJECT_ID condition where bucket corresponds toSCOPE
• deletes existing fleet scope RBAC role binding: roleadmin for userperson@google.com.

Scope resource - The group of arguments defining the Fleet Scope. Thisrepresents a Cloud resource. (NOTE) Some attributes are not given arguments inthis group but can be set in other ways.

To set theproject attribute:

• provide the argumentSCOPE on the command line with a fullyspecified name;
• provide the argument--project on the command line;
• set the propertycore/project.

To set thelocation attribute:

• provide the argumentSCOPE on the command line with a fullyspecified name;
• global is the only supported location.

This must be specified.

SCOPE

ID of the scope or fully qualified identifier for the scope.

To set thescope attribute:

• provide the argumentSCOPE on the command line.

Exactly one of these must be specified:

--group=GROUP

Group for the role binding.

--user=USER

User for the role binding.

Run$gcloud help for details.