Skip to content

Latest commit

 

History

History
45 lines (44 loc) · 2.01 KB

README.md

File metadata and controls

45 lines (44 loc) · 2.01 KB
Raw

Storage Bucket IAM

NAME

storage-bucket-iam

SYNOPSIS

Config Connector compatible yaml to enable permissions for a storage bucket.

CONSUMPTION

Download the package using kpt.

kpt pkg get https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit.git/config-connector/solutions/iam/kpt/storage-bucket-iam storage-bucket-iam

REQUIREMENTS

  • A working Config Connector instance.

  • A storage bucket managed by IAM.

  • The "cnrm-system" service account with roles/storage.admin in either the storage bucket or the project which owns the storage bucket.

    Note: Using uniform bucket-level access control is recommended for this package.

SETTERS

NAME VALUE SET BY DESCRIPTION COUNT
bucket-name ${BUCKET_NAME?} PLACEHOLDER name of storage bucket 1
iam-member ${IAM_MEMBER?} PLACEHOLDER member to grant role 1
role roles/storage.objectViewer package-default IAM role to grant 1

USAGE

Set the name of the bucket you want to configure permissions for.

kpt cfg set . bucket-name your-bucket

Set the IAM member to grant a role to.

kpt cfg set . iam-member user:name@example.com

Optionally, set the storage role (defaults to roles/storage.objectViewer) that you want to apply and the IAM member the role will apply to.

kpt cfg set . role roles/storage.admin

Once the configuration is satisfactory, apply:

kubectl apply -f .

LICENSE

Apache 2.0 - See LICENSE for more information.