Skip to content

Commit c61bd06

Browse files
adellapeadellape
authored
Merge pull request #56118 from xenolinux/minm-required-permissions-gcp
2 parents 776dbb2 + becfd9b commit c61bd06

File tree

1 file changed

+331
-0
lines changed

1 file changed

+331
-0
lines changed

‎modules/installation-gcp-permissions.adoc‎

Lines changed: 331 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,18 @@ endif::[]
1313
ifeval::["{context}" == "installing-gcp-user-infra-vpc"]
1414
:template:
1515
endif::[]
16+
ifeval::["{context}" == "installing-gcp-account"]
17+
:ipi:
18+
endif::[]
19+
ifeval::["{context}" == "installing-gcp-user-infra"]
20+
:upi:
21+
endif::[]
22+
ifeval::["{context}" == "installing-gcp-account"]
23+
:ipiupi:
24+
endif::[]
25+
ifeval::["{context}" == "installing-gcp-user-infra"]
26+
:ipiupi:
27+
endif::[]
1628

1729
[id="installation-gcp-permissions_{context}"]
1830
= Required GCP permissions
@@ -29,6 +41,291 @@ account requires the following permissions. If you deploy your cluster into an e
2941
* Service Account User
3042
* Storage Admin
3143

44+
ifdef::ipiupi[]
45+
The following are the required permissions for provisioning GCP infrastructure for creating and deleting the {product-title} cluster.
46+
47+
.Required permissions for creating network resources
48+
[%collapsible]
49+
====
50+
* `compute.addresses.create`
51+
* `compute.addresses.createInternal`
52+
* `compute.addresses.delete`
53+
* `compute.addresses.get`
54+
* `compute.addresses.list`
55+
* `compute.addresses.use`
56+
* `compute.addresses.useInternal`
57+
* `compute.firewalls.create`
58+
* `compute.firewalls.delete`
59+
* `compute.firewalls.get`
60+
* `compute.firewalls.list`
61+
* `compute.forwardingRules.create`
62+
* `compute.forwardingRules.get`
63+
* `compute.forwardingRules.list`
64+
* `compute.forwardingRules.setLabels`
65+
* `compute.networks.create`
66+
* `compute.networks.get`
67+
* `compute.networks.list`
68+
* `compute.networks.updatePolicy`
69+
* `compute.routers.create`
70+
* `compute.routers.get`
71+
* `compute.routers.list`
72+
* `compute.routers.update`
73+
* `compute.routes.list`
74+
* `compute.subnetworks.create`
75+
* `compute.subnetworks.get`
76+
* `compute.subnetworks.list`
77+
* `compute.subnetworks.use`
78+
* `compute.subnetworks.useExternalIp`
79+
====
80+
81+
.Required permissions for creating load balancer resources
82+
[%collapsible]
83+
====
84+
* `compute.regionBackendServices.create`
85+
* `compute.regionBackendServices.get`
86+
* `compute.regionBackendServices.list`
87+
* `compute.regionBackendServices.update`
88+
* `compute.regionBackendServices.use`
89+
* `compute.targetPools.addInstance`
90+
* `compute.targetPools.create`
91+
* `compute.targetPools.get`
92+
* `compute.targetPools.list`
93+
* `compute.targetPools.removeInstance`
94+
* `compute.targetPools.use`
95+
====
96+
97+
.Required permissions for creating DNS resources
98+
[%collapsible]
99+
====
100+
* `dns.changes.create`
101+
* `dns.changes.get`
102+
* `dns.managedZones.create`
103+
* `dns.managedZones.get`
104+
* `dns.managedZones.list`
105+
* `dns.networks.bindPrivateDNSZone`
106+
* `dns.resourceRecordSets.create`
107+
* `dns.resourceRecordSets.list`
108+
* `dns.resourceRecordSets.update`
109+
endif::ipiupi[]
110+
ifdef::upi[]
111+
* `dns.resourceRecordSets.update`
112+
endif::upi[]
113+
ifdef::ipiupi[]
114+
====
115+
116+
.Required permissions for creating Service Account resources
117+
[%collapsible]
118+
====
119+
* `iam.serviceAccountKeys.create`
120+
* `iam.serviceAccountKeys.delete`
121+
* `iam.serviceAccountKeys.get`
122+
* `iam.serviceAccountKeys.list`
123+
* `iam.serviceAccounts.actAs`
124+
* `iam.serviceAccounts.create`
125+
* `iam.serviceAccounts.delete`
126+
* `iam.serviceAccounts.get`
127+
* `iam.serviceAccounts.list`
128+
* `resourcemanager.projects.get`
129+
* `resourcemanager.projects.getIamPolicy`
130+
* `resourcemanager.projects.setIamPolicy`
131+
====
132+
133+
.Required permissions for creating compute resources
134+
[%collapsible]
135+
====
136+
* `compute.disks.create`
137+
* `compute.disks.get`
138+
* `compute.disks.list`
139+
* `compute.instanceGroups.create`
140+
* `compute.instanceGroups.delete`
141+
* `compute.instanceGroups.get`
142+
* `compute.instanceGroups.list`
143+
* `compute.instanceGroups.update`
144+
* `compute.instanceGroups.use`
145+
* `compute.instances.create`
146+
* `compute.instances.delete`
147+
* `compute.instances.get`
148+
* `compute.instances.list`
149+
* `compute.instances.setLabels`
150+
* `compute.instances.setMetadata`
151+
* `compute.instances.setServiceAccount`
152+
* `compute.instances.setTags`
153+
* `compute.instances.use`
154+
* `compute.machineTypes.get`
155+
* `compute.machineTypes.list`
156+
====
157+
158+
.Required for creating storage resources
159+
[%collapsible]
160+
====
161+
* `storage.buckets.create`
162+
* `storage.buckets.delete`
163+
* `storage.buckets.get`
164+
* `storage.buckets.list`
165+
* `storage.objects.create`
166+
* `storage.objects.delete`
167+
* `storage.objects.get`
168+
* `storage.objects.list`
169+
====
170+
171+
.Required permissions for creating health check resources
172+
[%collapsible]
173+
====
174+
* `compute.healthChecks.create`
175+
* `compute.healthChecks.get`
176+
* `compute.healthChecks.list`
177+
* `compute.healthChecks.useReadOnly`
178+
* `compute.httpHealthChecks.create`
179+
* `compute.httpHealthChecks.get`
180+
* `compute.httpHealthChecks.list`
181+
* `compute.httpHealthChecks.useReadOnly`
182+
====
183+
184+
.Required permissions to get GCP zone and region related information
185+
[%collapsible]
186+
====
187+
* `compute.globalOperations.get`
188+
* `compute.regionOperations.get`
189+
* `compute.regions.list`
190+
* `compute.zoneOperations.get`
191+
* `compute.zones.get`
192+
* `compute.zones.list`
193+
====
194+
195+
.Required permissions for checking services and quotas
196+
[%collapsible]
197+
====
198+
* `monitoring.timeSeries.list`
199+
* `serviceusage.quotas.get`
200+
* `serviceusage.services.list`
201+
====
202+
203+
.Required IAM permissions for installation
204+
[%collapsible]
205+
====
206+
* `iam.roles.get`
207+
====
208+
endif::ipiupi[]
209+
210+
ifdef::ipi[]
211+
.Optional Images permissions for installation
212+
[%collapsible]
213+
====
214+
* `compute.images.list`
215+
====
216+
endif::ipi[]
217+
ifdef::upi[]
218+
.Required Images permissions for installation
219+
[%collapsible]
220+
====
221+
* `compute.images.create`
222+
* `compute.images.delete`
223+
* `compute.images.get`
224+
* `compute.images.list`
225+
====
226+
endif::upi[]
227+
228+
ifdef::ipiupi[]
229+
.Optional permission for running gather bootstrap
230+
[%collapsible]
231+
====
232+
* `compute.instances.getSerialPortOutput`
233+
====
234+
235+
.Required permissions for deleting network resources
236+
[%collapsible]
237+
====
238+
* `compute.addresses.delete`
239+
* `compute.addresses.deleteInternal`
240+
* `compute.addresses.list`
241+
* `compute.firewalls.delete`
242+
* `compute.firewalls.list`
243+
* `compute.forwardingRules.delete`
244+
* `compute.forwardingRules.list`
245+
* `compute.networks.delete`
246+
* `compute.networks.list`
247+
* `compute.networks.updatePolicy`
248+
* `compute.routers.delete`
249+
* `compute.routers.list`
250+
* `compute.routes.list`
251+
* `compute.subnetworks.delete`
252+
* `compute.subnetworks.list`
253+
====
254+
255+
.Required permissions for deleting load balancer resources
256+
[%collapsible]
257+
====
258+
* `compute.regionBackendServices.delete`
259+
* `compute.regionBackendServices.list`
260+
* `compute.targetPools.delete`
261+
* `compute.targetPools.list`
262+
====
263+
264+
.Required permissions for deleting DNS resources
265+
[%collapsible]
266+
====
267+
* `dns.changes.create`
268+
* `dns.managedZones.delete`
269+
* `dns.managedZones.get`
270+
* `dns.managedZones.list`
271+
* `dns.resourceRecordSets.delete`
272+
* `dns.resourceRecordSets.list`
273+
====
274+
275+
.Required permissions for deleting Service Account resources
276+
[%collapsible]
277+
====
278+
* `iam.serviceAccounts.delete`
279+
* `iam.serviceAccounts.get`
280+
* `iam.serviceAccounts.list`
281+
* `resourcemanager.projects.getIamPolicy`
282+
* `resourcemanager.projects.setIamPolicy`
283+
====
284+
285+
.Required permissions for deleting compute resources
286+
[%collapsible]
287+
====
288+
* `compute.disks.delete`
289+
* `compute.disks.list`
290+
* `compute.instanceGroups.delete`
291+
* `compute.instanceGroups.list`
292+
* `compute.instances.delete`
293+
* `compute.instances.list`
294+
* `compute.instances.stop`
295+
* `compute.machineTypes.list`
296+
====
297+
298+
.Required for deleting storage resources
299+
[%collapsible]
300+
====
301+
* `storage.buckets.delete`
302+
* `storage.buckets.getIamPolicy`
303+
* `storage.buckets.list`
304+
* `storage.objects.delete`
305+
* `storage.objects.list`
306+
====
307+
308+
.Required permissions for deleting health check resources
309+
[%collapsible]
310+
====
311+
* `compute.healthChecks.delete`
312+
* `compute.healthChecks.list`
313+
* `compute.httpHealthChecks.delete`
314+
* `compute.httpHealthChecks.list`
315+
====
316+
317+
.Required Images permissions for deletion
318+
[%collapsible]
319+
====
320+
endif::ipiupi[]
321+
ifdef::upi[]
322+
* `compute.images.delete`
323+
endif::upi[]
324+
ifdef::ipiupi[]
325+
* `compute.images.list`
326+
====
327+
endif::ipiupi[]
328+
32329
.Required roles for creating network resources during installation
33330
* DNS Administrator
34331

@@ -40,6 +337,28 @@ ifdef::template[]
40337
.Required roles for user-provisioned GCP infrastructure
41338
* Deployment Manager Editor
42339
* Service Account Key Admin
340+
341+
ifdef::upi[]
342+
The following are the additional permissions required for user-provisioned GCP infrastructure for creating and deleting the {product-title} cluster.
343+
344+
.Required permissions to get Region related information
345+
[%collapsible]
346+
====
347+
* `compute.regions.get`
348+
====
349+
350+
.Required Deployment Manager permissions
351+
[%collapsible]
352+
====
353+
* `deploymentmanager.deployments.create`
354+
* `deploymentmanager.deployments.delete`
355+
* `deploymentmanager.deployments.get`
356+
* `deploymentmanager.deployments.list`
357+
* `deploymentmanager.manifests.get`
358+
* `deploymentmanager.operations.get`
359+
* `deploymentmanager.resources.list`
360+
====
361+
endif::upi[]
43362
endif::template[]
44363

45364
.Optional roles
@@ -79,3 +398,15 @@ endif::[]
79398
ifeval::["{context}" == "installing-gcp-user-infra-vpc"]
80399
:!template:
81400
endif::[]
401+
ifeval::["{context}" == "installing-gcp-account"]
402+
:!ipi:
403+
endif::[]
404+
ifeval::["{context}" == "installing-gcp-user-infra"]
405+
:!upi:
406+
endif::[]
407+
ifeval::["{context}" == "installing-gcp-account"]
408+
:!ipiupi:
409+
endif::[]
410+
ifeval::["{context}" == "installing-gcp-user-infra"]
411+
:!ipiupi:
412+
endif::[]

0 commit comments

Comments
 (0)