【发布时间】：2022-01-19 20:11:39
【问题描述】：
原来这是 Terraform 问题Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals
下面的原始问题
尝试以拥有 Owner 角色的用户身份创建 GKE 集群。但是它失败并显示错误消息。删除重试了几次，还是一样的错误。
请告知如何排除故障并了解原因。
用户
登录用户
服务帐号
GKE 服务帐号设置
错误
Google Compute Engine: Not all instances running in IGM after 15.945831085s.
Expected 3, running 0, transitioning 3.
Current errors:
[PERMISSIONS_ERROR]: Instance 'gke-cluster-1-default-pool-a3bd7bfb-cw7n' creation failed: Required 'compute.instances.create' permission for 'projects/412177242019/zones/us-central1-c/instances/gke-cluster-1-default-pool-a3bd7bfb-cw7n' (when acting as '412177242019@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-cluster-1-default-pool-a3bd7bfb-cw7n' creation failed: Required 'compute.disks.create' permission for 'projects/412177242019/zones/us-central1-c/disks/gke-cluster-1-default-pool-a3bd7bfb-cw7n' (when acting as '412177242019@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-cluster-1-default-pool-a3bd7bfb-cw7n' creation failed: Required 'compute.disks.setLabels' permission for 'projects/412177242019/zones/us-central1-c/disks/gke-cluster-1-default-pool-a3bd7bfb-cw7n' (when acting as '412177242019@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-cluster-1-default-pool-a3bd7bfb-cw7n' creation failed: Required 'compute.subnetworks.use' permission for 'projects/412177242019/regions/us-central1/subnetworks/default' (when acting as '412177242019@cloudservices.gserviceaccount.com');
[PERMISSIONS_ERROR]: Instance 'gke-cluster-1-default-pool-a3bd7bfb-cw7n' creation failed: Required 'compute.subnetworks.useExternalIp' permission for 'projects/412177242019/regions/us-central1/subnetworks/default' (when acting as '412177242019@cloudservices.gserviceaccount.com') (truncated).
更新
将“roles/compute.admin”添加到服务帐户。
$ gcloud iam service-accounts list
DISPLAY NAME EMAIL DISABLED
Compute Engine default service account 412177242019-compute@developer.gserviceaccount.com False
$ gcloud projects add-iam-policy-binding 'positive-theme-323611' --member=serviceAccount:412177242019-compute@developer.gserviceaccount.com --role='roles/compute.admin'
Updated IAM policy for project [positive-theme-323611].
bindings:
...
- members:
- serviceAccount:412177242019-compute@developer.gserviceaccount.com
role: roles/compute.admin
...
但是，还是有同样的问题。
Google Compute Engine: Not all instances running in IGM after 18.269931718s. Expected 3, running 0, transitioning 3. Current errors: [PERMISSIONS_ERROR]: Instance 'gke-cluster-4-default-pool-289807f2-5dh5' creation failed: Required 'compute.instances.create' permission for 'projects/412177242019/zones/us-central1-c/instances/gke-cluster-4-default-pool-289807f2-5dh5' (when acting as '412177242019@cloudservices.gserviceaccount.com'); [PERMISSIONS_ERROR]: Instance 'gke-cluster-4-default-pool-289807f2-5dh5' creation failed: Required 'compute.disks.create' permission for 'projects/412177242019/zones/us-central1-c/disks/gke-cluster-4-default-pool-289807f2-5dh5' (when acting as '412177242019@cloudservices.gserviceaccount.com'); [PERMISSIONS_ERROR]: Instance 'gke-cluster-4-default-pool-289807f2-5dh5' creation failed: Required 'compute.disks.setLabels' permission for 'projects/412177242019/zones/us-central1-c/disks/gke-cluster-4-default-pool-289807f2-5dh5' (when acting as '412177242019@cloudservices.gserviceaccount.com'); [PERMISSIONS_ERROR]: Instance 'gke-cluster-4-default-pool-289807f2-5dh5' creation failed: Required 'compute.subnetworks.use' permission for 'projects/412177242019/regions/us-central1/subnetworks/default' (when acting as '412177242019@cloudservices.gserviceaccount.com'); [PERMISSIONS_ERROR]: Instance 'gke-cluster-4-default-pool-289807f2-5dh5' creation failed: Required 'compute.subnetworks.useExternalIp' permission for 'projects/412177242019/regions/us-central1/subnetworks/default' (when acting as '412177242019@cloudservices.gserviceaccount.com') (truncated).
相关
【问题讨论】：
-
错误消息不是指您的 Gmail 帐户。服务帐号没有正确的 IAM 角色（权限）。将所需角色添加到 412177242019@cloudservices.gserviceaccount.com。
-
@JohnHanley，谢谢你的建议。我添加了 compute.admin 角色，但仍然是同样的错误。
-
您已将 compute.admin 角色添加到计算引擎默认服务帐户，但未添加到此服务帐户
412177242019@cloudservices.gserviceaccount.com。您的更新显示您已将其添加到其他服务帐户。 -
@SamStoelinga，感谢您的评论，结果是stackoverflow.com/questions/70703088/…，如果您有时间，请提供建议
标签： google-cloud-platform google-kubernetes-engine