ephemer
commented
1 year ago I just added the Service Usage Admin role to the skyplane service account and now I get a different error:
❌ GCPServer(region_tag=gcp:us-west1-b, instance_name=skyplane-gcp-410fdbe8814c4fb9b02f089f18d86144) encountered error:
Traceback (most recent call last):
File "/pkg/skyplane/gateway/gateway_obj_store.py", line 49, in get_obj_store_interface
self.obj_store_interfaces[key] = ObjectStoreInterface.create(region, bucket)
File "/pkg/skyplane/obj_store/object_store_interface.py", line 102, in create
return GCSInterface(bucket)
File "/pkg/skyplane/obj_store/gcs_interface.py", line 26, in __init__
self._gcs_client = self.auth.get_storage_client()
File "/pkg/skyplane/utils/imports.py", line 33, in wrapped
return fn(*modules_imported, *args, **kwargs)
File "/pkg/skyplane/compute/gcp/gcp_auth.py", line 200, in get_storage_client
return storage.Client.from_service_account_json(self.service_account_credentials)
File "/pkg/skyplane/compute/gcp/gcp_auth.py", line 68, in service_account_credentials
self._service_account_email = self.create_service_account(self.service_account_name)
File "/pkg/skyplane/compute/gcp/gcp_auth.py", line 179, in create_service_account
return retry_backoff(read_modify_write) # retry loop needed for concurrent policy modifications
File "/pkg/skyplane/utils/retry.py", line 30, in retry_backoff
raise e
File "/pkg/skyplane/utils/retry.py", line 27, in retry_backoff
return fn()
File "/pkg/skyplane/compute/gcp/gcp_auth.py", line 158, in read_modify_write
policy = service.projects().getIamPolicy(resource=self.project_id).execute()
File "/usr/local/lib/python3.10/site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
return wrapped(*args, **kwargs)
File "/usr/local/lib/python3.10/site-packages/googleapiclient/http.py", line 938, in execute
raise HttpError(resp, content, uri=self.uri)
googleapiclient.errors.HttpError: <HttpError 403 when requesting https://cloudresourcemanager.googleapis.com/v1/projects/note-detection-277711:getIamPolicy?alt=json returned "The caller does not have permission". Details: "The caller does not have permission">How do I find out who the "caller" is in this case so I can provide the correct permissions?
sarahwooders
Describe the bug I am trying to set up Skyplane to copy from
gs://tos3://. Right after the "Installing Gateway Package" step, where the actual transfer progress appears to begin, I get a403error thatCaller does not have required permission to use project <GCP PROJECT ID WHERE BUCKET IS LOCATED>.Grant the caller the roles/serviceusage.serviceUsageConsumer role, or a custom role with the serviceusage.services.use permission, by visiting https://console.developers.google.com/iam-admin/iam/project?project=<GCP PROJECT ID>.My GCP credentials are linked to the account owner, and the Service Account was created by Skyplane itself. There is no indication of who the "caller" is, or to whom I need to grant those roles.
I already granted that role to both the account admin account (the one logged in to
gcloud) and also to the Skyplane "manual" Service Account which was created duringskyplane init. I waited a number of hours after doing that and tried again and it still isn't working. There is no other "caller" I can imagine granting permissions to.To Reproduce Steps to reproduce the behavior (please include the full Skyplane command you ran):
pip install skyplane[aws,gcp]skyplane init(awsandgcloudare already set up,gcloudis logged in and set to the correct project)gcp_instance_classton2-standard-8because we can't raise our quota to allow more than 8 N2 coresskyplane cp --recursive --reuse-gateways --confirm gs://my_bucket s3://my-bucket--reuse-gatewaysI received timeouts waiting for the AWS EC2 instance to come onlineExpected behavior The transfer works
Screenshots
Transfer client log In the log output from Skyplane, please upload the debug log from the CLI. You can find the path to the file in the log output:
Environment info (please complete the following information):