Building a GKE cluster on GCP with Terraform permission error

Question

I am trying to add a GKE cluster using Terraform 0.12.5 [this used to be fine on 0.11.7 as far as I can tell]

resource "google_container_cluster" "primary" {
  name = "gke-${terraform.workspace}-cluster"
  zone = "${var.region}-b"

  initial_node_count = 3
  network            = "${var.vpc_name}"
  subnetwork         = "${var.subnet_name}"

  addons_config {

    horizontal_pod_autoscaling {
      disabled = false
    }

    kubernetes_dashboard {
      disabled = false
    }
  }

  # getting a vpc-native network
  ip_allocation_policy {
  }

  master_auth {
    username = "${var.gke_master_user}"
    password = "${var.gke_master_pass}"
  }

  node_config {
    oauth_scopes = [
      "https://www.googleapis.com/auth/compute",
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]

    labels = {
      env = "${var.gke_label[terraform.workspace]}"
    }

    disk_size_gb = 10
    machine_type = "${var.gke_node_machine_type}"
    tags         = ["gke-node"]
  }
}

I run this based on a service-account with the following roles

roles/compute.networkAdmin
roles/resourcemanager.projectCreator
roles/storage.admin

However to my surprise I now get permission issues in building the GKE cluster.

1) deploy error: Not all instances running in IGM after 10.808470514s. 
Expect 1. Current errors: [PERMISSIONS_ERROR]: Instance 'gke-gke-dev- 
cluster-default-pool-6266baac-0pn3' creation failed: Required 
'compute.instances.create' permission for 
'projects/353065647996/zones/europe-west1-b/instances/gke-gke-dev- 
cluster-default-pool-6266baac-0pn3' (when acting as 
'353065647996@cloudservices.gserviceaccount.com'); 
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool- 
6266baac-0pn3' creation failed: Required 'compute.disks.create' 
permission for 'projects/353065647996/zones/europe-west1-b/disks/gke- 
gke-dev-cluster-default-pool-6266baac-0pn3' (when acting as 
'353065647996@cloudservices.gserviceaccount.com'); 
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool- 
6266baac-0pn3' creation failed: Required 'compute.subnetworks.use' 
permission for 'projects/353065647996/regions/europe- 
west1/subnetworks/dev-subnet' (when acting as 
'353065647996@cloudservices.gserviceaccount.com'); 
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool- 
6266baac-0pn3' creation failed: Required 
'compute.subnetworks.useExternalIp' permission for 
'projects/353065647996/regions/europe-west1/subnetworks/dev-subnet' 
(when acting as '353065647996@cloudservices.gserviceaccount.com'); 
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool- 
6266baac-0pn3' creation failed: Required 
'compute.instances.setMetadata' permission for 
'projects/353065647996/zones/europe-west1-b/instances/gke-gke-dev- 
cluster-default-pool-6266baac-0pn3' (when acting as 
'353065647996@cloudservices.gserviceaccount.com') (truncated)

This service account 353065647996@cloudservices.gserviceaccount.com is created for a project and inherits of the original service account. It is not clear to me how to provide it with the correct roles / credentials.

score 0 · Accepted Answer · answered Jul 27 '19 at 15:56

0

This was caused by adding a user with only viewing rights as the last user when creating the project. Removing that user and it worked as predicted.

answered Jul 27 '19 at 15:56

Mike

3,775
8
39
79

Having the same issue but I don't fully understand your answer. Could you elaborate? – soupdiver Jan 13 '20 at 19:35
I had 2 users in terraform 1 "superuser" and a lesser user. For some reason having this second minor user made the system break down. – Mike Jan 14 '20 at 22:19
Interesting ... for the the issue was, that the default ServiceAccount had no permissions for some reason. Giving Editor role it through IAM solved it – soupdiver Jan 17 '20 at 09:57
If you are coming here from a similar error but you have shared VPC, the help is found [here](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-shared-vpc) – chanux Feb 25 '20 at 10:01
1

This answer is not correct. Removing a user will not **magically** solve permission problems on another identity. The error message is clear that the service account was missing the required roles. – John Hanley Jan 13 '22 at 04:24

score 0 · Answer 2 · answered Sep 06 '22 at 05:51

The error message says it all:

[PERMISSIONS_ERROR]: Instance 'XXX' creation failed: Required 'compute.instances.create' permission for 'projects/xxx' (when acting as 'xxx@cloudservices.gserviceaccount.com')

Adding the missing permissions to the service account xxx@cloudservices.gserviceaccount.com should solve the problem.

Building a GKE cluster on GCP with Terraform permission error

2 Answers2

Linked