google-github-actions/get-gke-credentials failed with: required "container.clusters.get" permission(s)

[thardy]

I think I'm asking for help here more than anything, or perhaps a significant improvement to your documentation. I've followed everything to the letter, and I'm receiving "google-github-actions/get-gke-credentials failed with: required "container.clusters.get" permission(s)". I'm trying to use the "Direct Workload Identity Federation" option. All the "advice" I find online tells me I need to setup a service account, but your documentation seems pretty clear that with the Direct Workload Identity Federation "there are no intermediate service accounts or keys".

Please let me know what I'm missing.

Here is my action yaml...

name: deploy-k8s-manifests

on:
  push:
    branches:
      - dev
    paths:
      - 'k8s/**'

jobs:
  deploy:
    runs-on: ubuntu-latest

    # Add "id-token" with the intended permissions.
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Get code
        uses: actions/checkout@v4

      - name: Authenticate with GCP
        id: 'auth'
        uses: google-github-actions/auth@v2
        with:
          project_id: 'my-project'
          workload_identity_provider: 'projects/297600345299/locations/global/workloadIdentityPools/github/providers/my-provider'

      - name: Get GKE credentials
        id: 'get-credentials'
        uses: google-github-actions/get-gke-credentials@v2
        with:
          cluster_name: 'preprod'
          location: 'us-central1'

      - name: Apply k8s manifests in GCP
        run: kubectl apply -f k8s

Here is my action output (the relevant portions)...

Authenticate with GCP
Run google-github-actions/auth@v2
Created credentials file at "/home/runner/work/my-project/my-project/gha-creds-c9c4d62169250d9a.json"

Get GKE credentials
Run google-github-actions/get-gke-credentials@v2
Error: google-github-actions/get-gke-credentials failed with: required "container.clusters.get" permission(s) for "projects/my-project/locations/us-central1/clusters/preprod".

[github-actions[bot]]

Hi there @thardy :wave:!

Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.

[sethvargo]

Duplicate of https://github.com/google-github-actions/get-gke-credentials/issues/309