Closed carlhejiayu closed 5 years ago
Additional information: Our current terraforming-gcp version is 0.28.0
After further testing, we also noticed that the service account "master" for PKS created through terraform, is unable to compute.zones.list. However, if we manually create service accounts with the same roles through the web browser, we are able to run gcloud compute zones list
for our manually created account. The terraform created account errors when we run the same command with:
ERROR: (gcloud.compute.zones.list) Some requests did not succeed:
- Required 'compute.zones.list' permission for <PROJECT NAME>
I've seen similar before. Can you check that in your browser whether you granted instanceAdmin.v1 or instanceAdmin beta?
I have noticed the same issue that the PKS IAM roles is different to PKS documents, including both Ops Manager SA and PKS Master node SA. I have used v0.54.0 as well as the master
branch to see the errors.
for example, the Ops Manager SA Roles from Docs -
ROLE
roles/compute.instanceAdmin.v1
roles/compute.networkAdmin
roles/compute.storageAdmin
roles/iam.serviceAccountKeyAdmin
roles/iam.serviceAccountUser
roles/storage.admin
and Ops Manager SA roles from terraform
ROLE
roles/compute.instanceAdmin
roles/compute.networkAdmin
roles/compute.storageAdmin
roles/iam.serviceAccountActor
roles/storage.admin
I corrected those with the repo (https://github.com/oahcran/terraforming-gcp/tree/pks-iam-roles) and let me know if PR is accepted.
@oahcran we'd gladly accept a PR for this. Sorry for the delay!
The terraform for PKS iam roles differ from the documentation. Currently, out of box, we were unable to create a cluster after the infrastructure is deployed with terraform. The additional changes needed from the documentation for successful cluster creation was to add more roles to the ops manager and master PKS service accounts. (https://docs.pivotal.io/runtimes/pks/1-1/gcp-service-accounts.html)
Ops Manager:
PKS Master:
It should also be noted that there are inconsistencies with the usage of ServiceAccountUser role. This role is being deprecated, and should be replaced with ServiceAccountActor. To get the equivalent of ServiceAccountUser, we would need in addition to ServiceAccountActor, to include ServiceAccountTokenCreator.