K
Q

Cloud container clusters create `compute.networks.get` permission error

11/8/2019

I am trying to create a cluster with GKE. I have a project I have been using already.

When I run

gcloud container clusters create cluster1

I get the following:

ERROR: (gcloud.container.clusters.create) ResponseError: code=403, message=Google Compute Engine: Required 'compute.networks.get' permission for 'projects//global/networks/default'.

The same thing happens when I use the web UI. Both my service account and my user have owner roles.

I have tried the following to get the cluster create command to work:

  1. I tried adding a policy binding for the project for my existing service account:
gcloud projects add-iam-policy-binding <my-project> \
    --member serviceAccount:<my-user>@<my-project>.iam.gserviceaccount.com \
    --role  roles/compute.admin
  1. I read enabling the container api service was required

gcloud services enable container.googleapis.com

  1. Started over. I deleted the service account, created a new one and activated the creds with:
gcloud auth activate-service-account <my-user>@<my-project>.iam.gserviceaccount.com --key-file ${GOOGLE_APPLICATION_CREDENTIALS}
  1. I also tried authenticating with my account user:
gcloud auth login

None of these work and I can't create a cluster

-- gordon macmillan
cluster-computing
gcloud
google-cloud-iam
google-cloud-platform
google-kubernetes-engine

Similar Questions

Looking for feedbacks to implement continuous deployment on Kubernetes
Kubernetes 1.16 logstash helm chat no matches for kind "StatefulSet" in version "apps/v1beta2"
Is there a way for recovering PVC, pods and volume attachment information from detached volumes when EKS cluster is recreated
GKE - GPU nvidia - cuda drivers dont work
Change Public GKE to Private GKE cluster using terraform
Template.yaml and constraint.yaml for rego policy
Kubernetes Ingress 502

2 Answers

11/8/2019

I think you should set the compute engine service account permission:

 gcloud projects add-iam-policy-binding <my-project> \
--member [PROJECT_NUMBER]-compute@developer.gserviceaccount.com \
--role  roles/compute.admin
-- marian.vladoi
Source: StackOverflow
11/11/2019

I think I will answer my own question here. From service account docs

When you create a new Cloud project using GCP Console and if Compute Engine API is enabled for your project, a Compute Engine Service account is created for you by default. It is identifiable using the email:

PROJECT_NUMBER-compute@developer.gserviceaccount.com

I had delete the default created service accounts somehow and possible the associated roles. I think this is why I couldn't create a cluster under my project anymore. Rather than try to figure out how to recreate, I decided it was best to just start a new project. Afterwords, the cluster create API and console work just fine.

-- gordon macmillan
Source: StackOverflow