-
Notifications
You must be signed in to change notification settings - Fork 43
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
permission denied despite creating service account #142
Comments
On a hunch I enabled the GKE Workload Identity service on my cluster and now I am getting
|
@philips thanks for the report and for the extra information about Workload Identity. In both cases I see credential errors in the logs you posted. The first error indicates that the service account doesn't have the right permissions. See the instructions here on how to set it up correctly: https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa The second error indicates that the Stackdriver Prometheus integration cannot find credentials using Application Default Credentials. If the link above doesn't help you solve this issue, please see https://cloud.google.com/docs/authentication/production I also see that Stackdriver may use the node's service account while GKE Workload Identity Service is in beta, but I'm not sure whether it applies to the Prometheus integration, so something to keep in mind: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#limitations |
These two fields were filled out wrong. This fixes the issue here: Stackdriver/stackdriver-prometheus-sidecar#142
@jkohen Thanks for your help. With fresh eyes this morning I noticed the project and the cluster name were inversed. ::facepalm:: After I fixed that everything works as expected. I will close this but it would be really cool if there were a way for the application to know the difference between having incorrect permissions and incorrect configuration. Failing that it might be good to have a debug FAQ that addresses an IAM misconfiguration looks identical to typos of the flags. Thanks! |
refer: GKE workload identity
|
I followed these steps to setup my Prometheus + Stackdriver stack.
The text was updated successfully, but these errors were encountered: