GCP restore between projects creates restore disk in original project

[jg-baracoda]

I followed the example:
https://github.com/vmware-tanzu/velero-plugin-for-gcp/blob/main/examples/gcp-projects.md

Project staging and prod.

Tried on Velero 1.10.1 1.10.0 1.9.6 with versions of gcp plugin v1.6.1 v1.6.0 v1.5.4.

Installed Velero on cluster on prod. Created main snapshot location on project prod.
Success on creating backup of pv and pvc. This resulted in snapshot created on project prod.

Installed Velero on cluster on staging. Created main snapshot location on project staging.
Added service account from project staging to project prod.
Created restore that passed in staging cluster. But after a while I noticed that pod is not waking up. After reviewing the normal error for pvc not able to find the disk on the staging project I found out:
Turns out the disk "restore-xyz" has been created on prod instead of staging.

I expected it to create disk on staging that would be attached. It's possible but somehow it's not working with Velero.

It's not even trying to create disk in staging project.

[jg-baracoda]

Further investigation:

Google advice to create snapshot in restore project.

I think there is issue with Volumesnapshotlocation.

If I install Velero in prod with prod credentials (Credentials have prod project) and create snapshot location with project from staging:

Velero is looking for disk on staging project instead of the one from credentials.

If I create Velero in staging with staging credentials (Credentials with staging project) and create snapshot location with project from prod:

Velero is looking for snapshot on prod (as desired) but then creates the disk also in snapshot location. Totally ignores the local project from credentials...

[blackpiglet]

Will trace this issue in #6038.

[AgustinRamiroDiaz]

Hi! I just hit this in velero 1.11.1, with GCP plugin 1.7.0

velero version
Client:
	Version: v1.11.1
	Git commit: -
Server:
	Version: v1.11.1

My restore logs look like this

error executing PVAction for persistentvolumes/pvc-[...]: rpc error: code = Unknown desc = googleapi: Error 403: Required 'compute.disks.create' permission for 'projects/<OLD_PROJECT>/zones/europe-north1-a/disks/restore-[...]', forbidden

[blackpiglet]

@AgustinRamiroDiaz
A new issue is created to trace this request.
#6848