I have a container running within GCE kubernetes engine which is trying to copy some data from a bucket to a mounted persistent disk:
gsutil -m rsync -r -d "gs://${DB_BUCKET}/db" /dbWhen the container runs, it fails with the following message:
AccessDeniedException: 403 xxx-service@my-project.iam.gserviceaccount.com does not have storage.objects.list access to my-bucket-db-dataIf I look at the service account, it does appear to have permissions to view storage buckets. I create a populate this bucket as part of my deployment process if that makes any difference.
What permissions do I need to grant/how to be able to sync the data from the bucket across?
You need to add referred permission to xxx-service@my-project.iam.gserviceaccount.com:
Follow this steps:
1) Access Permissions tab into ${DB_BUCKET}
2) Search for your service account in the search input field
3) In the Role(s) column find "Storage Object Viewer" role