add-iam-policy-binding 到 ESP 端点服务 GCloud 时出错

Question

I am trying to create an end point for an API to be deployed into existing GKE cluster by following the instructions in Getting started with Cloud Endpoints for GKE with ESPv2

I clone the sample code in the repo and modified the content of openapi.yaml:

# [START swagger]
swagger: "2.0"
info:
  description: "A simple Google Cloud Endpoints API example."
  title: "Endpoints Example"
  version: "1.0.0"
host: "my-api.endpoints.my-project.cloud.goog"

I then deployed it via the command:

endpoints/getting-started (master) $ gcloud endpoints services deploy openapi.yaml

Now I can see that it has been created:

$ gcloud endpoints services list
NAME                                                         TITLE
my-api.endpoints.my-project.cloud.goog

I also have postgreSQL service account:

$ gcloud iam service-accounts list
DISPLAY NAME                   EMAIL                          DISABLED
my-postgresql-service-account  my-postgresql-service-acco@my-project.iam.gserviceaccount.com  False

In the section Endpoint Service Configuration of documentation it says to add the role to the attached service account for the endpoint service as follows, but I get this error:

$ gcloud endpoints services add-iam-policy-binding my-api.endpoints.my-project.cloud.goog 
--member serviceAccount:my-postgresql-service-acco@my-project.iam.gserviceaccount.com
--role roles/servicemanagement.serviceController
ERROR: (gcloud.endpoints.services.add-iam-policy-binding) User [myusername@mycompany.com] does not have permission to access services instance [my-api.endpoints.my-project.cloud.goog:getIamPolicy] (or it may not exist): No access to resource: services/my-api.my-project.cloud.goog

The previous lines show the service exits, I guess? Now I am not sure how to resolve this? What permissions do I need? who can give me permission and what permissions he should have? how can I check? Is there any other solution?

Answer 1

The issue got resolved after I was assigned the role of "Project_Admin". It was not ideal as it was giving too much permission to me. The role "roles/endpoints.portalAdmin" was also tried but did not help.