gcloud:用户无法访问服务帐户"默认"

Question

我尝试使用一个激活的服务帐户作用域来创建和删除gcloud容器集群(k8s集群),使用以下命令:

gcloud config configurations create my-svc-account \
   --no-activate \
   --project myProject


gcloud auth activate-service-account my-svc-account@my-project.iam.gserviceaccount.com \
   --key-file=/path/to/keyfile.json \
   --configuration my-svc-account

gcloud container clusters create a-new-cluster \
   --configuration my-svc-account \
   --project= my-project
   --zone "my-zone"

我总是收到错误:

...ERROR: (gcloud.container.clusters.create) ResponseError: code=400, message=The user does not have access to service account "default".

如何授予my-svc-account访问GKE默认服务帐户的权限？

Answer 1

与Google支持人员交谈后,问题是该服务帐户未激活"服务帐户角色"权限.添加"服务帐户Actor"可以解决此错误.

Answer 2

将以下角色添加到执行操作的服务帐户:

Service Account User

另见:

• https://cloud.google.com/kubernetes-engine/docs/how-to/iam#service_account_user

• https://cloud.google.com/iam/docs/service-accounts#the_service_account_user_role

• https://cloud.google.com/iam/docs/understanding-roles