[英]Building a GKE cluster on GCP with Terraform permission error
我正在尝试使用 Terraform 0.12.5 添加 GKE 集群 [据我所知,这在 0.11.7 上曾经很好]
resource "google_container_cluster" "primary" {
name = "gke-${terraform.workspace}-cluster"
zone = "${var.region}-b"
initial_node_count = 3
network = "${var.vpc_name}"
subnetwork = "${var.subnet_name}"
addons_config {
horizontal_pod_autoscaling {
disabled = false
}
kubernetes_dashboard {
disabled = false
}
}
# getting a vpc-native network
ip_allocation_policy {
}
master_auth {
username = "${var.gke_master_user}"
password = "${var.gke_master_pass}"
}
node_config {
oauth_scopes = [
"https://www.googleapis.com/auth/compute",
"https://www.googleapis.com/auth/devstorage.read_only",
"https://www.googleapis.com/auth/logging.write",
"https://www.googleapis.com/auth/monitoring",
]
labels = {
env = "${var.gke_label[terraform.workspace]}"
}
disk_size_gb = 10
machine_type = "${var.gke_node_machine_type}"
tags = ["gke-node"]
}
}
我基于具有以下角色的服务帐户运行它
然而令我惊讶的是,我现在在构建 GKE 集群时遇到了权限问题。
1) deploy error: Not all instances running in IGM after 10.808470514s.
Expect 1. Current errors: [PERMISSIONS_ERROR]: Instance 'gke-gke-dev-
cluster-default-pool-6266baac-0pn3' creation failed: Required
'compute.instances.create' permission for
'projects/353065647996/zones/europe-west1-b/instances/gke-gke-dev-
cluster-default-pool-6266baac-0pn3' (when acting as
'353065647996@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool-
6266baac-0pn3' creation failed: Required 'compute.disks.create'
permission for 'projects/353065647996/zones/europe-west1-b/disks/gke-
gke-dev-cluster-default-pool-6266baac-0pn3' (when acting as
'353065647996@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool-
6266baac-0pn3' creation failed: Required 'compute.subnetworks.use'
permission for 'projects/353065647996/regions/europe-
west1/subnetworks/dev-subnet' (when acting as
'353065647996@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool-
6266baac-0pn3' creation failed: Required
'compute.subnetworks.useExternalIp' permission for
'projects/353065647996/regions/europe-west1/subnetworks/dev-subnet'
(when acting as '353065647996@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-gke-dev-cluster-default-pool-
6266baac-0pn3' creation failed: Required
'compute.instances.setMetadata' permission for
'projects/353065647996/zones/europe-west1-b/instances/gke-gke-dev-
cluster-default-pool-6266baac-0pn3' (when acting as
'353065647996@cloudservices.gserviceaccount.com') (truncated)
此服务帐户 353065647996@cloudservices.gserviceaccount.com 是为项目创建的,并继承了原始服务帐户。 我不清楚如何为其提供正确的角色/凭据。
这是由于在创建项目时添加了仅具有查看权限的用户作为最后一个用户。 删除该用户,它按预期工作。
错误消息说明了一切:
[PERMISSIONS_ERROR]: Instance 'XXX' creation failed: Required 'compute.instances.create' permission for 'projects/xxx' (when acting as 'xxx@cloudservices.gserviceaccount.com')
将缺少的权限添加到服务帐户xxx@cloudservices.gserviceaccount.com
应该可以解决问题。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.