RBACRoleBinding represents a rbacrolebinding across the Fleet.
To get more information about MembershipRBACRoleBinding, see:
resource "google_container_cluster" "primary" {
provider = google-beta
name = "basic-cluster"
location = "us-central1-a"
initial_node_count = 1
deletion_protection = "true"
network = "default"
subnetwork = "default"
}
resource "google_gke_hub_membership" "membership" {
provider = google-beta
membership_id = "tf-test-membership%{random_suffix}"
endpoint {
gke_cluster {
resource_link = "//container.googleapis.com/${google_container_cluster.primary.id}"
}
}
depends_on = [google_container_cluster.primary]
}
resource "google_gke_hub_membership_rbac_role_binding" "membership_rbac_role_binding" {
provider = google-beta
membership_rbac_role_binding_id = "tf-test-membership-rbac-role-binding%{random_suffix}"
membership_id = google_gke_hub_membership.membership.membership_id
user = "service-${data.google_project.project.number}@gcp-sa-anthossupport.iam.gserviceaccount.com"
role {
predefined_role = "ANTHOS_SUPPORT"
}
location = "global"
depends_on = [google_gke_hub_membership.membership]
}
data "google_project" "project" {
provider = google-beta
}
The following arguments are supported:
membership_rbac_role_binding_id
-
(Required)
The client-provided identifier of the RBAC Role Binding.
user
-
(Required)
Principal that is be authorized in the cluster (at least of one the oneof
is required). Updating one will unset the other automatically.
user is the name of the user as seen by the kubernetes cluster, example
"alice" or "alice@domain.tld"
role
-
(Required)
Role to bind to the principal.
Structure is documented below.
membership_id
-
(Required)
Id of the membership
location
-
(Required)
Location of the Membership
predefined_role
-
(Required)
PredefinedRole is an ENUM representation of the default Kubernetes Roles
Possible values are: UNKNOWN
, ADMIN
, EDIT
, VIEW
, ANTHOS_SUPPORT
.project
- (Optional) The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.In addition to the arguments listed above, the following computed attributes are exported:
id
- an identifier for the resource with format projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}/rbacrolebindings/{{membership_rbac_role_binding_id}}
name
-
The resource name for the RBAC Role Binding
uid
-
Google-generated UUID for this resource.
create_time
-
Time the RBAC Role Binding was created in UTC.
update_time
-
Time the RBAC Role Binding was updated in UTC.
delete_time
-
Time the RBAC Role Binding was deleted in UTC.
state
-
State of the RBAC Role Binding resource.
Structure is documented below.
code
-
(Output)
Code describes the state of a RBAC Role Binding resource.This resource provides the following Timeouts configuration options:
create
- Default is 20 minutes.delete
- Default is 20 minutes.MembershipRBACRoleBinding can be imported using any of these accepted formats:
projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}/rbacrolebindings/{{membership_rbac_role_binding_id}}
{{project}}/{{location}}/{{membership_id}}/{{membership_rbac_role_binding_id}}
{{location}}/{{membership_id}}/{{membership_rbac_role_binding_id}}
In Terraform v1.5.0 and later, use an import
block to import MembershipRBACRoleBinding using one of the formats above. For example:
import {
id = "projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}/rbacrolebindings/{{membership_rbac_role_binding_id}}"
to = google_gke_hub_membership_rbac_role_binding.default
}
When using the terraform import
command, MembershipRBACRoleBinding can be imported using one of the formats above. For example:
$ terraform import google_gke_hub_membership_rbac_role_binding.default projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}/rbacrolebindings/{{membership_rbac_role_binding_id}}
$ terraform import google_gke_hub_membership_rbac_role_binding.default {{project}}/{{location}}/{{membership_id}}/{{membership_rbac_role_binding_id}}
$ terraform import google_gke_hub_membership_rbac_role_binding.default {{location}}/{{membership_id}}/{{membership_rbac_role_binding_id}}
This resource supports User Project Overrides.