The product described by this documentation, GKE on Azure, is now in maintenance mode and will be shut down on March 17, 2027.

API roles and permissions

GKE on Azure has specific Identity and Access Management (IAM) permissions. Those permissions are described in the following tables. For instructions on managing permissions, see Granting, Changing, and Revoking Access to Resources .

GKE on Azure API permissions

The GKE on Azure API includes the predefined gkemulticloud.viewer , and gkemulticloud.admin roles. These roles are described in the following table:

Role

Permissions

Anthos Multi-cloud Admin

( roles/ gkemulticloud.admin )

Admin access to Anthos Multi-cloud resources.

gkemulticloud.*

gkemulticloud. attachedClusters. create
gkemulticloud. attachedClusters. delete
gkemulticloud. attachedClusters. generateInstallManifest
gkemulticloud. attachedClusters. get
gkemulticloud. attachedClusters. import
gkemulticloud. attachedClusters. list
gkemulticloud. attachedClusters. update
gkemulticloud. attachedServerConfigs. get
gkemulticloud. awsClusters. create
gkemulticloud. awsClusters. delete
gkemulticloud. awsClusters. generateAccessToken
gkemulticloud.awsClusters.get
gkemulticloud. awsClusters. getAdminKubeconfig
gkemulticloud.awsClusters.list
gkemulticloud. awsClusters. update
gkemulticloud. awsNodePools. create
gkemulticloud. awsNodePools. delete
gkemulticloud.awsNodePools.get
gkemulticloud. awsNodePools. list
gkemulticloud. awsNodePools. update
gkemulticloud. awsServerConfigs. get
gkemulticloud. azureClients. create
gkemulticloud. azureClients. delete
gkemulticloud.azureClients.get
gkemulticloud. azureClients. list
gkemulticloud. azureClusters. create
gkemulticloud. azureClusters. delete
gkemulticloud. azureClusters. generateAccessToken
gkemulticloud. azureClusters. get
gkemulticloud. azureClusters. getAdminKubeconfig
gkemulticloud. azureClusters. list
gkemulticloud. azureClusters. update
gkemulticloud. azureNodePools. create
gkemulticloud. azureNodePools. delete
gkemulticloud. azureNodePools. get
gkemulticloud. azureNodePools. list
gkemulticloud. azureNodePools. update
gkemulticloud. azureServerConfigs. get
gkemulticloud. operations. cancel
gkemulticloud. operations. delete
gkemulticloud.operations.get
gkemulticloud.operations.list
gkemulticloud.operations.wait

resourcemanager.projects.get

resourcemanager.projects.list

Anthos Multi-cloud Viewer

( roles/ gkemulticloud.viewer )

Viewer access to Anthos Multi-cloud resources.

gkemulticloud. attachedClusters. generateInstallManifest

gkemulticloud. attachedClusters. get

gkemulticloud. attachedClusters. list

gkemulticloud. attachedServerConfigs. get

gkemulticloud. awsClusters. generateAccessToken

gkemulticloud.awsClusters.get

gkemulticloud.awsClusters.list

gkemulticloud.awsNodePools.get

gkemulticloud. awsNodePools. list

gkemulticloud. awsServerConfigs. get

gkemulticloud.azureClients.get

gkemulticloud. azureClients. list

gkemulticloud. azureClusters. generateAccessToken

gkemulticloud. azureClusters. get

gkemulticloud. azureClusters. list

gkemulticloud. azureNodePools. get

gkemulticloud. azureNodePools. list

gkemulticloud. azureServerConfigs. get

gkemulticloud.operations.get

gkemulticloud.operations.list

gkemulticloud.operations.wait

resourcemanager.projects.get

resourcemanager.projects.list

What's next

Additional IAM roles, such as owner and editor, include GKE on Azure permissions. For more information, see the complete IAM Permissions reference list.