Create storage WORM buckets

This page guides you through how to create Write Once Read Many (WORM) storage buckets in Google Distributed Cloud (GDC) air-gapped environments. This covers the prerequisites and steps for creating a WORM bucket with a defined retention period, and for granting access permissions using role bindings. This information lets you enforce strict data retention practices and immutability, providing robust and compliant data storage for records and use cases like audit logging.

This page is for audiences such as IT administrators within the infrastructure operator group or developers within the application operator group who manage data retention and compliance settings for storage buckets in GDC air-gapped environments. For more information, see Audiences for GDC air-gapped documentation.

Before you begin

A project namespace manages bucket resources in the management API server. You must have a project to work with buckets and objects.

Required IAM roles

Contact your IAM Project Admin to request the following roles in your project namespace:

Project Bucket Admin (project-bucket-admin): create, update, and delete storage buckets.
Project Bucket Object Viewer (project-bucket-object-viewer): view and check details of storage buckets and objects.

For more information, see Grant bucket access.

Prepare your environment

To run commands against the management API server or the global API server, do the following:

Sign in and generate the kubeconfig file for the zonal management API server if you don't have one.
For dual-zone buckets, do the following:
- Verify with your Infrastructure Operator (IO) that the BucketLocationConfig custom resource has been created for your paired zones.
- Generate the kubeconfig file for the global API server.

Create a WORM bucket

A WORM bucket ensures that nothing else overwrites objects and it retains them for a minimum period of time. Audit logging is an example use case for a WORM bucket.

Take the following steps to create a WORM bucket:

Set a retention period when creating the bucket. The retention period defines how many days each object version is locked against deletion or modification. This retention period is distinct from the storage class minimum storage duration (such as the 30-day minimum for the Standard storage class). For example, the following bucket sets a retention period of 365 days. Contact your Infrastructure Operator (IO) if you need to exceed retention policy limits.
```
apiVersion: object.gdc.goog/v1
kind: Bucket
metadata:
  name: foo-logging-bucket
  namespace: foo-service
spec:
  description: "Audit logs for foo"
  storageClass: Standard
  bucketPolicy:
    lockingPolicy:
      defaultObjectRetentionDays: 365
```

Grant the project-bucket-object-viewer role to all users who need read-only access:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: foo-service
  name: object-readonly-access
roleRef:
  kind: Role
  name: project-bucket-object-viewer
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  namespace: foo-service
  name: foo-log-processor
- kind: User
  name: bob@example.com
  apiGroup: rbac.authorization.k8s.io

Grant the project-bucket-object-admin role to users who need to write content to the bucket:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: foo-service
  name: object-write-access
roleRef:
  kind: Role
  name: project-bucket-object-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  namespace: foo-service
  name: foo-service-account