GCE与Kubernetes权限问题：新项目部署集群遇权限报错求助

Hey there! Let's walk through the most likely fixes for your permission issues with the new GCE project—this is super common when setting up Kubernetes in a fresh project, so don't stress too much.

1. Double-Check IAM Roles for Service Accounts & Users #

• First, confirm the service account (or your personal user account, if you're running the script directly) has the necessary roles in the new project. In your old working project, it probably had roles like roles/container.admin, roles/compute.admin, and roles/iam.serviceAccountUser—these are non-negotiable for deploying and managing K8s clusters.
  • Head to the GCE IAM page for your new project, locate the account in question, and verify those roles are assigned.
• Don't forget the default node service account attached to your cluster's GCE instances—make sure it has the roles/container.nodeServiceAccount role. Missing this often causes random runtime permission errors.

2. Refresh Kubernetes Credentials #

• Your local kubeconfig file might still be pointing to your old project's credentials. Run this command to update it to the new project:

  gcloud container clusters get-credentials [YOUR_CLUSTER_NAME] --zone [YOUR_CLUSTER_ZONE] --project [NEW_PROJECT_ID]
  

• After that, confirm your kubectl context is targeting the right project with:

  kubectl config get-contexts
  

  Ensure the active context matches your new cluster and project ID.

3. Fix Kubectl Proxy Access Permissions #

• The error when hitting http://localhost:8001/ typically means your user doesn't have permission to list cluster-wide resources. Test this with:

  kubectl auth can-i list pods --all-namespaces
  

  If it returns no, you'll need to grant your user appropriate cluster roles. For a quick test (don't leave this in production!), you can bind the cluster-admin role temporarily:

  kubectl create clusterrolebinding [YOUR_GCP_EMAIL]-cluster-admin --clusterrole=cluster-admin --user=[YOUR_GCP_EMAIL]
  

4. Validate Your Deployment Script Configuration #

• It's easy to accidentally hardcode your old project ID in variables or gcloud commands in your script. Go through line by line to ensure every reference to a project uses the new ID.
• Also, check if your script uses a service account key file—make sure it's the key for the new project's service account, not the old one. Using an outdated key will trigger permission errors even if roles are set correctly.

5. Enable Required GCE APIs #

• New GCE projects don't have all APIs enabled by default. Make sure these critical APIs are turned on:
  • Kubernetes Engine API (container.googleapis.com)
  • Compute Engine API (compute.googleapis.com)
  • Identity and Access Management API (iam.googleapis.com)
    You can enable them via the GCP Console or with this command:

  gcloud services enable container.googleapis.com compute.googleapis.com iam.googleapis.com --project [NEW_PROJECT_ID]
  

内容的提问来源于stack exchange，提问作者Tino