GKE Hub roles and permissions

This page lists the IAM roles and permissions for GKE Hub. To search through all roles and permissions, see the role and permission index.

GKE Hub roles

Role Permissions

Fleet Admin (formerly GKE Hub Admin)

(roles/gkehub.admin)

Full access to Fleet resources.

gkehub.features.*

  • gkehub.features.create
  • gkehub.features.delete
  • gkehub.features.get
  • gkehub.features.getIamPolicy
  • gkehub.features.list
  • gkehub.features.setIamPolicy
  • gkehub.features.update

gkehub.fleet.*

  • gkehub.fleet.create
  • gkehub.fleet.createFreeTrial
  • gkehub.fleet.delete
  • gkehub.fleet.get
  • gkehub.fleet.getFreeTrial
  • gkehub.fleet.update
  • gkehub.fleet.updateFreeTrial

gkehub.locations.*

  • gkehub.locations.get
  • gkehub.locations.list

gkehub.membershipbindings.*

  • gkehub.membershipbindings.create
  • gkehub.membershipbindings.delete
  • gkehub.membershipbindings.get
  • gkehub.membershipbindings.list
  • gkehub.membershipbindings.update

gkehub.membershipfeatures.*

  • gkehub.membershipfeatures.create
  • gkehub.membershipfeatures.delete
  • gkehub.membershipfeatures.get
  • gkehub.membershipfeatures.list
  • gkehub.membershipfeatures.update

gkehub.memberships.*

  • gkehub.memberships.create
  • gkehub.memberships.delete
  • gkehub.memberships.generateConnectManifest
  • gkehub.memberships.get
  • gkehub.memberships.getIamPolicy
  • gkehub.memberships.list
  • gkehub.memberships.setIamPolicy
  • gkehub.memberships.update

gkehub.namespaces.*

  • gkehub.namespaces.create
  • gkehub.namespaces.delete
  • gkehub.namespaces.get
  • gkehub.namespaces.list
  • gkehub.namespaces.update

gkehub.operations.*

  • gkehub.operations.cancel
  • gkehub.operations.delete
  • gkehub.operations.get
  • gkehub.operations.list

gkehub.rbacrolebindings.*

  • gkehub.rbacrolebindings.create
  • gkehub.rbacrolebindings.delete
  • gkehub.rbacrolebindings.get
  • gkehub.rbacrolebindings.list
  • gkehub.rbacrolebindings.update

gkehub.scopes.*

  • gkehub.scopes.create
  • gkehub.scopes.delete
  • gkehub.scopes.get
  • gkehub.scopes.getIamPolicy
  • gkehub.scopes.list
  • gkehub.scopes.listBoundMemberships
  • gkehub.scopes.setIamPolicy
  • gkehub.scopes.update

resourcemanager.projects.get

resourcemanager.projects.list

Fleet Editor (formerly GKE Hub Editor)

(roles/gkehub.editor)

Edit access to Fleet resources.

gkehub.features.create

gkehub.features.delete

gkehub.features.get

gkehub.features.getIamPolicy

gkehub.features.list

gkehub.features.update

gkehub.fleet.*

  • gkehub.fleet.create
  • gkehub.fleet.createFreeTrial
  • gkehub.fleet.delete
  • gkehub.fleet.get
  • gkehub.fleet.getFreeTrial
  • gkehub.fleet.update
  • gkehub.fleet.updateFreeTrial

gkehub.locations.*

  • gkehub.locations.get
  • gkehub.locations.list

gkehub.membershipbindings.*

  • gkehub.membershipbindings.create
  • gkehub.membershipbindings.delete
  • gkehub.membershipbindings.get
  • gkehub.membershipbindings.list
  • gkehub.membershipbindings.update

gkehub.membershipfeatures.*

  • gkehub.membershipfeatures.create
  • gkehub.membershipfeatures.delete
  • gkehub.membershipfeatures.get
  • gkehub.membershipfeatures.list
  • gkehub.membershipfeatures.update

gkehub.memberships.create

gkehub.memberships.delete

gkehub.memberships.generateConnectManifest

gkehub.memberships.get

gkehub.memberships.getIamPolicy

gkehub.memberships.list

gkehub.memberships.update

gkehub.namespaces.*

  • gkehub.namespaces.create
  • gkehub.namespaces.delete
  • gkehub.namespaces.get
  • gkehub.namespaces.list
  • gkehub.namespaces.update

gkehub.operations.*

  • gkehub.operations.cancel
  • gkehub.operations.delete
  • gkehub.operations.get
  • gkehub.operations.list

gkehub.rbacrolebindings.*

  • gkehub.rbacrolebindings.create
  • gkehub.rbacrolebindings.delete
  • gkehub.rbacrolebindings.get
  • gkehub.rbacrolebindings.list
  • gkehub.rbacrolebindings.update

gkehub.scopes.create

gkehub.scopes.delete

gkehub.scopes.get

gkehub.scopes.getIamPolicy

gkehub.scopes.list

gkehub.scopes.listBoundMemberships

gkehub.scopes.update

resourcemanager.projects.get

resourcemanager.projects.list

Fleet Viewer (formerly GKE Hub Viewer)

(roles/gkehub.viewer)

Read-only access to Fleets and related resources.

gkehub.features.get

gkehub.features.getIamPolicy

gkehub.features.list

gkehub.fleet.get

gkehub.fleet.getFreeTrial

gkehub.locations.*

  • gkehub.locations.get
  • gkehub.locations.list

gkehub.membershipbindings.get

gkehub.membershipbindings.list

gkehub.membershipfeatures.get

gkehub.membershipfeatures.list

gkehub.memberships.generateConnectManifest

gkehub.memberships.get

gkehub.memberships.getIamPolicy

gkehub.memberships.list

gkehub.namespaces.get

gkehub.namespaces.list

gkehub.operations.get

gkehub.operations.list

gkehub.rbacrolebindings.get

gkehub.rbacrolebindings.list

gkehub.scopes.get

gkehub.scopes.list

gkehub.scopes.listBoundMemberships

resourcemanager.projects.get

resourcemanager.projects.list

GKE Connect Agent

(roles/gkehub.connect)

Ability to set up GKE Connect between external clusters and Google.

gkehub.endpoints.connect

Connect Gateway Admin

(roles/gkehub.gatewayAdmin)

Full access to Connect Gateway.

gkehub.gateway.*

  • gkehub.gateway.delete
  • gkehub.gateway.generateCredentials
  • gkehub.gateway.get
  • gkehub.gateway.patch
  • gkehub.gateway.post
  • gkehub.gateway.put
  • gkehub.gateway.stream

gkehub.memberships.get

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.values.test

Connect Gateway Editor

(roles/gkehub.gatewayEditor)

Edit access to Connect Gateway.

gkehub.gateway.delete

gkehub.gateway.generateCredentials

gkehub.gateway.get

gkehub.gateway.patch

gkehub.gateway.post

gkehub.gateway.put

gkehub.memberships.get

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.values.test

Connect Gateway Reader

(roles/gkehub.gatewayReader)

Read-only access to Connect Gateway.

gkehub.gateway.generateCredentials

gkehub.gateway.get

gkehub.memberships.get

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.values.test

Fleet Scope Admin

(roles/gkehub.scopeAdmin)

Admin access to Fleet Scopes to set IAM Bindings and RBACRoleBindings.

gkehub.namespaces.create

gkehub.namespaces.delete

gkehub.namespaces.get

gkehub.namespaces.list

gkehub.rbacrolebindings.*

  • gkehub.rbacrolebindings.create
  • gkehub.rbacrolebindings.delete
  • gkehub.rbacrolebindings.get
  • gkehub.rbacrolebindings.list
  • gkehub.rbacrolebindings.update

gkehub.scopes.get

gkehub.scopes.getIamPolicy

gkehub.scopes.listBoundMemberships

gkehub.scopes.setIamPolicy

Fleet Scope Editor

(roles/gkehub.scopeEditor)

Edit access to Namespaces under Fleet Scopes.

gkehub.namespaces.create

gkehub.namespaces.delete

gkehub.namespaces.get

gkehub.namespaces.list

gkehub.rbacrolebindings.get

gkehub.rbacrolebindings.list

gkehub.scopes.get

gkehub.scopes.getIamPolicy

gkehub.scopes.listBoundMemberships

Fleet Project-level Scope Editor

(roles/gkehub.scopeEditorProjectLevel)

Role for project-level permissions for editor of Fleet Scopes.

gkehub.gateway.delete

gkehub.gateway.generateCredentials

gkehub.gateway.get

gkehub.gateway.patch

gkehub.gateway.post

gkehub.gateway.put

gkehub.memberships.get

gkehub.operations.get

monitoring.timeSeries.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.values.test

Fleet Scope Viewer

(roles/gkehub.scopeViewer)

Viewer of Fleet Scopes and associated resources.

gkehub.namespaces.get

gkehub.namespaces.list

gkehub.rbacrolebindings.get

gkehub.rbacrolebindings.list

gkehub.scopes.get

gkehub.scopes.getIamPolicy

gkehub.scopes.listBoundMemberships

Fleet Project-level Scope Viewer

(roles/gkehub.scopeViewerProjectLevel)

Role for project-level permissions for viewer of Fleet Scopes.

gkehub.gateway.generateCredentials

gkehub.gateway.get

gkehub.memberships.get

monitoring.timeSeries.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.values.test

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

GKE Hub Cross Project Service Agent

(roles/gkehub.crossProjectServiceAgent)

Gives the GKE Hub service agent permission to manage the project for cross-project fleet registration.

resourcemanager.projects.getIamPolicy

resourcemanager.projects.setIamPolicy

GKE Hub Service Agent

(roles/gkehub.serviceAgent)

Gives the GKE Hub service agent access to Cloud Platform resources.

container.clusterRoleBindings.*

  • container.clusterRoleBindings.create
  • container.clusterRoleBindings.delete
  • container.clusterRoleBindings.get
  • container.clusterRoleBindings.list
  • container.clusterRoleBindings.update

container.clusterRoles.*

  • container.clusterRoles.bind
  • container.clusterRoles.create
  • container.clusterRoles.delete
  • container.clusterRoles.escalate
  • container.clusterRoles.get
  • container.clusterRoles.list
  • container.clusterRoles.update

container.clusters.connect

container.clusters.get

container.clusters.list

container.clusters.update

container.customResourceDefinitions.create

container.customResourceDefinitions.delete

container.customResourceDefinitions.get

container.customResourceDefinitions.list

container.customResourceDefinitions.update

container.namespaces.get

container.operations.get

container.thirdPartyObjects.*

  • container.thirdPartyObjects.create
  • container.thirdPartyObjects.delete
  • container.thirdPartyObjects.get
  • container.thirdPartyObjects.list
  • container.thirdPartyObjects.update

gkehub.features.create

gkehub.features.get

gkehub.features.list

gkehub.fleet.create

gkehub.fleet.get

gkehub.gateway.delete

gkehub.gateway.generateCredentials

gkehub.gateway.get

gkehub.gateway.patch

gkehub.gateway.post

gkehub.gateway.put

gkehub.locations.*

  • gkehub.locations.get
  • gkehub.locations.list

gkehub.memberships.create

gkehub.memberships.generateConnectManifest

gkehub.memberships.get

gkehub.memberships.list

gkehub.operations.get

gkemulticloud.awsClusters.get

gkemulticloud.azureClusters.get

gkeonprem.bareMetalClusters.get

gkeonprem.vmwareClusters.get

logging.buckets.create

logging.buckets.get

logging.buckets.list

logging.buckets.update

logging.exclusions.*

  • logging.exclusions.create
  • logging.exclusions.delete
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.exclusions.update

logging.sinks.*

  • logging.sinks.create
  • logging.sinks.delete
  • logging.sinks.get
  • logging.sinks.list
  • logging.sinks.update

logging.views.create

logging.views.get

logging.views.list

logging.views.update

monitoring.metricsScopes.link

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

GKE Hub permissions

Permission Included in roles

gkehub.endpoints.connect

Owner (roles/owner)

Velostrata Manager (roles/cloudmigration.inframanager)

Velostrata Manager Connection Agent (roles/cloudmigration.velostrataconnect)

GKE Connect Agent (roles/gkehub.connect)

Service agent roles

gkehub.features.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.features.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.features.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.features.getIamPolicy

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.features.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.features.setIamPolicy

Owner (roles/owner)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Security Admin (roles/iam.securityAdmin)

Service agent roles

gkehub.features.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.fleet.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.fleet.createFreeTrial

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.fleet.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.fleet.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.fleet.getFreeTrial

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.fleet.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.fleet.updateFreeTrial

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.gateway.delete

Owner (roles/owner)

Editor (roles/editor)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Service agent roles

gkehub.gateway.generateCredentials

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Connect Gateway Reader (roles/gkehub.gatewayReader)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Fleet Project-level Scope Viewer (roles/gkehub.scopeViewerProjectLevel)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.gateway.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Connect Gateway Reader (roles/gkehub.gatewayReader)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Fleet Project-level Scope Viewer (roles/gkehub.scopeViewerProjectLevel)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.gateway.patch

Owner (roles/owner)

Editor (roles/editor)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Service agent roles

gkehub.gateway.post

Owner (roles/owner)

Editor (roles/editor)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Service agent roles

gkehub.gateway.put

Owner (roles/owner)

Editor (roles/editor)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Service agent roles

gkehub.gateway.stream

Owner (roles/owner)

Editor (roles/editor)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Service agent roles

gkehub.locations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.locations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.membershipbindings.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.membershipbindings.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.membershipbindings.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.membershipbindings.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.membershipbindings.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.membershipfeatures.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.membershipfeatures.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.membershipfeatures.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.membershipfeatures.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.membershipfeatures.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.memberships.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.memberships.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.memberships.generateConnectManifest

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.memberships.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Connect Gateway Admin (roles/gkehub.gatewayAdmin)

Connect Gateway Editor (roles/gkehub.gatewayEditor)

Connect Gateway Reader (roles/gkehub.gatewayReader)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Fleet Project-level Scope Viewer (roles/gkehub.scopeViewerProjectLevel)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.memberships.getIamPolicy

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.memberships.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.memberships.setIamPolicy

Owner (roles/owner)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Security Admin (roles/iam.securityAdmin)

Service agent roles

gkehub.memberships.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.namespaces.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Service agent roles

gkehub.namespaces.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Service agent roles

gkehub.namespaces.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.namespaces.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.namespaces.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.operations.cancel

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.operations.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.operations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Fleet Project-level Scope Editor (roles/gkehub.scopeEditorProjectLevel)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.operations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.rbacrolebindings.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Service agent roles

gkehub.rbacrolebindings.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Service agent roles

gkehub.rbacrolebindings.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.rbacrolebindings.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.rbacrolebindings.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Service agent roles

gkehub.scopes.create

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.scopes.delete

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

gkehub.scopes.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.scopes.getIamPolicy

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.scopes.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.scopes.listBoundMemberships

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Fleet Viewer (formerly GKE Hub Viewer) (roles/gkehub.viewer)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

Fleet Scope Editor (roles/gkehub.scopeEditor)

Fleet Scope Viewer (roles/gkehub.scopeViewer)

Support User (roles/iam.supportUser)

Service agent roles

gkehub.scopes.setIamPolicy

Owner (roles/owner)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Security Admin (roles/iam.securityAdmin)

Fleet Scope Admin (roles/gkehub.scopeAdmin)

gkehub.scopes.update

Owner (roles/owner)

Editor (roles/editor)

Fleet Admin (formerly GKE Hub Admin) (roles/gkehub.admin)

Fleet Editor (formerly GKE Hub Editor) (roles/gkehub.editor)

Service agent roles

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026年08月28日 UTC.