具有“roles/container.admin”的 Google 云服务帐户

Question

I am trying to create a Service Account with 'roles/container.admin' and i get an error saying that the role is not supported for this resource.

$ gcloud iam service-accounts add-iam-policy-binding sa-ci-vm@PROJECT-ID.iam.gserviceaccount.com --member='serviceAccount:sa-ci-vm@PROJECT-ID.iam.gserviceaccount.com' --role='roles/container.admin'

ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Role roles/container.admin is not supported for this resource.

If I create a Service Account from the CONSOLE UI I can add this role without a problem.

Answer 1

You have to use gcloud projects to add roles for a service account at a project level as shown here .

This works for me:

gcloud projects add-iam-policy-binding PROJECT_ID \ 
--member serviceAccount:sa-ci-vm@PROJECT-ID.iam.gserviceaccount.com \
--role roles/container.admin

Answer 2

I got the same error. You have to give the absolute path to the role.

cloud iam service-accounts add-iam-policy-binding SERVICEACCOUNT --member= SERVICEACCOUNT_EMAIL --role=projects/ PROJECTNAME /roles/ ROLENAME