This page lists the IAM roles and permissions for Google Distributed Cloud. To search through all roles and permissions, see the role and permission index .
Google Distributed Cloud roles
GKE on-prem Admin
( roles/
)
Full access to GKE on-prem all resources.
gkeonprem.*
-
gkeonprem.bareMetalAdminClusters. connect -
gkeonprem.bareMetalAdminClusters. create -
gkeonprem.bareMetalAdminClusters. createTagBinding -
gkeonprem.bareMetalAdminClusters. deleteTagBinding -
gkeonprem.bareMetalAdminClusters. enroll -
gkeonprem.bareMetalAdminClusters. get -
gkeonprem.bareMetalAdminClusters. getIamPolicy -
gkeonprem.bareMetalAdminClusters. list -
gkeonprem.bareMetalAdminClusters. listEffectiveTags -
gkeonprem.bareMetalAdminClusters. listTagBindings -
gkeonprem.bareMetalAdminClusters. queryVersionConfig -
gkeonprem.bareMetalAdminClusters. setIamPolicy -
gkeonprem.bareMetalAdminClusters. unenroll -
gkeonprem.bareMetalAdminClusters. update -
gkeonprem.bareMetalClusters. create -
gkeonprem.bareMetalClusters. createTagBinding -
gkeonprem.bareMetalClusters. delete -
gkeonprem.bareMetalClusters. deleteTagBinding -
gkeonprem.bareMetalClusters. enroll -
gkeonprem.bareMetalClusters. get -
gkeonprem.bareMetalClusters. getIamPolicy -
gkeonprem.bareMetalClusters. list -
gkeonprem.bareMetalClusters. listEffectiveTags -
gkeonprem.bareMetalClusters. listTagBindings -
gkeonprem.bareMetalClusters. queryVersionConfig -
gkeonprem.bareMetalClusters. setIamPolicy -
gkeonprem.bareMetalClusters. unenroll -
gkeonprem.bareMetalClusters. update -
gkeonprem.bareMetalNodePools. create -
gkeonprem.bareMetalNodePools. delete -
gkeonprem.bareMetalNodePools. enroll -
gkeonprem.bareMetalNodePools. get -
gkeonprem.bareMetalNodePools. getIamPolicy -
gkeonprem.bareMetalNodePools. list -
gkeonprem.bareMetalNodePools. setIamPolicy -
gkeonprem.bareMetalNodePools. unenroll -
gkeonprem.bareMetalNodePools. update -
gkeonprem.locations.get -
gkeonprem.locations.list -
gkeonprem.operations.cancel -
gkeonprem.operations.delete -
gkeonprem.operations.get -
gkeonprem.operations.list -
gkeonprem.vmwareAdminClusters. connect -
gkeonprem.vmwareAdminClusters. createTagBinding -
gkeonprem.vmwareAdminClusters. deleteTagBinding -
gkeonprem.vmwareAdminClusters. enroll -
gkeonprem.vmwareAdminClusters. get -
gkeonprem.vmwareAdminClusters. getIamPolicy -
gkeonprem.vmwareAdminClusters. list -
gkeonprem.vmwareAdminClusters. listEffectiveTags -
gkeonprem.vmwareAdminClusters. listTagBindings -
gkeonprem.vmwareAdminClusters. setIamPolicy -
gkeonprem.vmwareAdminClusters. unenroll -
gkeonprem.vmwareAdminClusters. update -
gkeonprem.vmwareClusters. create -
gkeonprem.vmwareClusters. createTagBinding -
gkeonprem.vmwareClusters. delete -
gkeonprem.vmwareClusters. deleteTagBinding -
gkeonprem.vmwareClusters. enroll -
gkeonprem.vmwareClusters.get -
gkeonprem.vmwareClusters. getIamPolicy -
gkeonprem.vmwareClusters.list -
gkeonprem.vmwareClusters. listEffectiveTags -
gkeonprem.vmwareClusters. listTagBindings -
gkeonprem.vmwareClusters. queryVersionConfig -
gkeonprem.vmwareClusters. setIamPolicy -
gkeonprem.vmwareClusters. unenroll -
gkeonprem.vmwareClusters. update -
gkeonprem.vmwareNodePools. create -
gkeonprem.vmwareNodePools. delete -
gkeonprem.vmwareNodePools. enroll -
gkeonprem.vmwareNodePools.get -
gkeonprem.vmwareNodePools. getIamPolicy -
gkeonprem.vmwareNodePools.list -
gkeonprem.vmwareNodePools. setIamPolicy -
gkeonprem.vmwareNodePools. unenroll -
gkeonprem.vmwareNodePools. update
resourcemanager.projects.get
resourcemanager.projects.list
GKE on-prem Viewer
( roles/
)
Read-only access to GKE on-prem all resources.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.locations.*
-
gkeonprem.locations.get -
gkeonprem.locations.list
gkeonprem.operations.get
gkeonprem.operations.list
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.vmwareClusters.get
gkeonprem.
gkeonprem.vmwareClusters.list
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.vmwareNodePools.get
gkeonprem.
gkeonprem.vmwareNodePools.list
resourcemanager.projects.get
resourcemanager.projects.list
Service agent roles
Service agent roles should only be granted to service agents .
| Role | Permissions |
|---|---|
GKE On-Prem Service Agent( Gives the GKE On-Prem service agent access to Cloud Platform resources. |
|
Google Distributed Cloud permissions
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE Hub Service Agent
(
roles/)gkehub.serviceAgent - GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
gkeonprem.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.operations.cancel
gkeonprem.operations.delete
gkeonprem.operations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.operations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.vmwareClusters.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE Hub Service Agent
(
roles/)gkehub.serviceAgent - GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.vmwareClusters.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
gkeonprem.
gkeonprem.
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.vmwareNodePools.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Support User
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.vmwareNodePools.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
GKE on-prem Admin
( roles/
)
GKE on-prem Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
gkeonprem.
Owner
( roles/
)
GKE on-prem Admin
( roles/
)
Security Admin
( roles/
)
gkeonprem.
Owner
( roles/
)
Editor
( roles/
)
GKE on-prem Admin
( roles/
)
Service agent roles
- GKE On-Prem Service Agent
(
roles/)gkeonprem.serviceAgent
