Role

API resource reference for Role, part of the IAM service. To create or change one, see Changing resources; to inspect, see Reading resources.

This resource is part of the v1alpha1 API and is subject to change. Fields and behavior may change in future releases.

Identity


Group	`iam.miloapis.com`
Version	`v1alpha1`
Kind	`Role`
Scope	Project

Overview

A Role is a named collection of permissions that can be granted to users, groups, or machine accounts through an IAM policy. Each permission follows the {service}.{resource}.{action} format (for example, compute.workloads.create). Use a Role to bundle the permissions a person or system needs, then bind that Role in a policy to grant access within a Project. Roles can also inherit permissions from other roles, so you can compose broader roles from narrower ones.

Spec fields

Field	Type	Required	Description
`spec.launchStage`	string	Yes	The launch stage of the role. One of `Early Access`, `Alpha`, `Beta`, `Stable`, or `Deprecated`.
`spec.includedPermissions`	[]string	No	The names of the permissions this role grants, each in `{service}.{resource}.{action}` format (e.g., `compute.workloads.create`).
`spec.inheritedRoles`	[]Object	No	The list of roles from which this role inherits permissions.
`spec.inheritedRoles[].name`	string	Yes	Name of the referenced Role.
`spec.inheritedRoles[].namespace`	string	No	Namespace of the referenced Role. Defaults to the namespace of the resource containing this reference.

Status fields (read-only)

Field	Type	Description
`status.effectivePermissions`	[]string	The complete flattened list of all permissions granted by this role, including those from `inheritedRoles` and `includedPermissions`. Computed by the controller.
`status.parent`	string	The resource name of the parent the role was created under.
`status.conditions`	[]Object	Conditions representing the current status of the role.
`status.observedGeneration`	integer	The most recent generation observed by the controller.

Usage

apiVersion: iam.miloapis.com/v1alpha1
kind: Role
metadata:
  name: workload-editor
spec:
  launchStage: Alpha
  includedPermissions:
    - compute.workloads.create
    - compute.workloads.update
    - compute.workloads.get

datumctl apply -f role.yaml --project my-project
datumctl get roles.iam.miloapis.com --project my-project
datumctl describe roles.iam.miloapis.com workload-editor --project my-project

Run datumctl explain roles.iam.miloapis.com --recursive to see the full, live field tree for this resource.

Overview

Concepts

Resource Manager

IAM

Compute

Networking

DNS

IPAM

Quota

Billing

Telemetry

Notification

Platform resources

Identity

Overview

Spec fields

Status fields (read-only)

Usage

​Identity

​Overview

​Spec fields

​Status fields (read-only)

​Usage

Identity

Overview

Spec fields

Status fields (read-only)

Usage