PolicyBinding

API resource reference for PolicyBinding, part of the IAM service. To create or change one, see Changing resources; to inspect, see Reading resources.

This resource is part of the v1alpha1 API and is subject to change. Fields and behavior may change in future releases.

Identity


Group	`iam.miloapis.com`
Version	`v1alpha1`
Kind	`PolicyBinding`
Scope	Project

Overview

A PolicyBinding grants access by binding a Role to one or more subjects (users, groups, or service accounts) for a specific set of resources. Use it to control who can act on what within a Project: you pick the role that defines the permissions, list the subjects that receive them, and select the resources the role applies to.

Spec fields

Field	Type	Required	Description
`spec.roleRef`	Object	Yes	Reference to the Role being bound.
`spec.roleRef.name`	string	Yes	Name of the referenced Role.
`spec.roleRef.namespace`	string	No	Namespace of the referenced Role. If empty, the PolicyBinding’s own scope is assumed.
`spec.subjects`	[]Object	Yes	The identities the role applies to.
`spec.subjects[].kind`	string	Yes	Type of subject. One of `User`, `Group`, or `ServiceAccount`.
`spec.subjects[].name`	string	Yes	Name of the subject. The special group name `system:authenticated-users` refers to all authenticated users.
`spec.subjects[].namespace`	string	No	Scope of the subject. Ignored for Users, Groups, and ServiceAccounts when not specified.
`spec.subjects[].uid`	string	No	Unique identifier of the subject. Optional for `system:` groups.
`spec.resourceSelector`	Object	Yes	Selects which resources the role applies to. `resourceKind` and `resourceRef` are mutually exclusive.
`spec.resourceSelector.resourceKind`	Object	No	Apply the role to all resources of a specific kind.
`spec.resourceSelector.resourceKind.kind`	string	Yes	The resource type being referenced.
`spec.resourceSelector.resourceKind.apiGroup`	string	No	API group of the resource type. If omitted, the kind must be in the core API group.
`spec.resourceSelector.resourceRef`	Object	No	Apply the role to a single, specific resource instance.
`spec.resourceSelector.resourceRef.kind`	string	Yes	The resource type being referenced.
`spec.resourceSelector.resourceRef.name`	string	Yes	Name of the resource being referenced.
`spec.resourceSelector.resourceRef.uid`	string	Yes	Unique identifier of the resource being referenced.
`spec.resourceSelector.resourceRef.apiGroup`	string	No	API group of the resource. Required for third-party types; if omitted, the kind must be in the core API group.
`spec.resourceSelector.resourceRef.namespace`	string	No	Scope of the resource. Required for Project-scoped resources; omitted for Platform-scoped resources.

Status fields (read-only)

Field	Type	Description
`status.conditions`	[]Object	Conditions representing the current status of the PolicyBinding.
`status.observedGeneration`	integer	The most recent generation observed for this PolicyBinding by the controller.

Usage

apiVersion: iam.miloapis.com/v1alpha1
kind: PolicyBinding
metadata:
  name: dns-editors
spec:
  roleRef:
    name: dns-editor
  subjects:
    - kind: User
      name: alice@example.com
  resourceSelector:
    resourceKind:
      apiGroup: dns.networking.miloapis.com
      kind: DNSZone

datumctl apply -f policybinding.yaml --project my-project
datumctl get policybindings.iam.miloapis.com --project my-project
datumctl describe policybindings.iam.miloapis.com dns-editors --project my-project

Run datumctl explain policybindings.iam.miloapis.com --recursive to see the full, live field tree for this resource.

Overview

Concepts

Resource Manager

IAM

Compute

Networking

DNS

IPAM

Quota

Billing

Telemetry

Notification

Platform resources

Identity

Overview

Spec fields

Status fields (read-only)

Usage

​Identity

​Overview

​Spec fields

​Status fields (read-only)

​Usage

Identity

Overview

Spec fields

Status fields (read-only)

Usage