Answers: <p>I think the error has more to do with the service account permissions running your cluster.  I'd make sure all the permissions are included, like <em>storage.ojjects.get</em>.  The error seems very permissions related.</p>
  <pre><code>Caller does not have storage.objects.get access to the Google Cloud Storage object.
  </code></pre>
  <p>You might be hitting this issue Google has reported:<br />
  <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes</a></p>
  <p>I'd listen to their recommendations over mine.</p>
  <p>When managing IAM roles, you can treat a service account either as a resource or as an identity. This <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/get-iam-policy" rel="nofollow noreferrer">command</a> is to get the iam policy of a service account resource. There are other gcloud commands to manage IAM policies for other types of resources. For example, to manage IAM policies on a project, use the $ gcloud projects commands and for services use $ gcloud iam service-accounts.</p>
  <p>This will return your service running the cluster w/ role assignment (it's the robot one :) )</p>
  <pre><code>gcloud projects get-iam-policy &lt;PROJECT-NAME&gt; 
  </code></pre>
  <p>The problem is sometimes running these commands requires special permissions too, so it becomes fools progress.  I think this link may be helpful.  it shows how to set permissions on a service-account.</p>
  <p><a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding" rel="nofollow noreferrer">https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding</a></p>
  <p>Also here is Google dictionary of IAM permissions including
  <em>storage.ojjects.get</em>.</p>
  <p><a href="https://cloud.google.com/iam/docs/understanding-roles" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/understanding-roles</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2022-03-22T05:18:47.170Z
Answers: 2022-03-22T05:26:31.240Z
Answers: 2022-03-22T05:26:31.240Z
Answers: Personal Assistant
Body: <p>I am trying to use the workflow orchestrator Snakemake with a Google Kubernetes Engine (GKE) <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview" rel="nofollow noreferrer">autopilot</a> cluster. My workflow needs to upload files to Google Cloud Storage buckets within the same project. Both <a href="https://snakemake.readthedocs.io/en/v7.2.1/executing/cloud.html#setup-kubernetes-on-google-cloud-engine" rel="nofollow noreferrer">Snakemake</a> and <a href="https://cloud.google.com/deep-learning-containers/docs/kubernetes-container" rel="nofollow noreferrer">GKE documentations</a> specify that a Google Storage read-write scope should be specified when the cluster is created, via <code>--scopes storage-rw</code>.</p>
  <p>I tried doing so with an autopilot cluster:</p>
  <pre><code>gcloud container --project &quot;project-name&quot; clusters create-auto &quot;default-cluster&quot; \
      --region &quot;asia-southeast2&quot; --release-channel &quot;regular&quot; \
      --network &quot;projects/project-name/global/networks/default&quot; \
      --subnetwork &quot;projects/project-name/regions/asia-southeast2/subnetworks/default&quot; \
      --cluster-ipv4-cidr &quot;/17&quot; --services-ipv4-cidr &quot;/22&quot; --scopes storage-rw
  </code></pre>
  <p>(I generated this command using the Google Cloud web console, then added the <code>--scopes storage-rw</code> argument at the end.)</p>
  <p>But I still get a Snakemake error message related to lack of permission for Google Storage read-write:</p>
  <pre><code>google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/kubernetes-nccs-npc2/o/whoami.txt?fields=name&amp;prettyPrint=false: Caller does not have storage.objects.get access to the Google Cloud Storage object.
  </code></pre>
  <p>It seems <code>--scopes storage-rw</code> does not work for the creation of autopilot clusters. Is this true? If so, how can I grant Google Storage read-write access to an autopilot cluster?</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-11-23T22:44:50.323Z
Comments: were you able to find a solution?
Comments: Mohsin
Tags: <kubernetes><google-cloud-platform><google-kubernetes-engine><google-cloud-storage>
Title: Google Kubernetes Engine's auto-pilot mode does not grant nodes Google Storage write access
UserDisplayName: ning
ThreadText: # Google Kubernetes Engine's auto-pilot mode does not grant nodes Google Storage write access
  
  (Asked by: username_0 on 2022-03-18)
  
  I am trying to use the workflow orchestrator Snakemake with a Google Kubernetes Engine (GKE) [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview) cluster. My workflow needs to upload files to Google Cloud Storage buckets within the same project. Both [Snakemake](https://snakemake.readthedocs.io/en/v7.2.1/executing/cloud.html#setup-kubernetes-on-google-cloud-engine) and [GKE documentations](https://cloud.google.com/deep-learning-containers/docs/kubernetes-container) specify that a Google Storage read-write scope should be specified when the cluster is created, via `--scopes storage-rw`.
  
  I tried doing so with an autopilot cluster:
  
  ```
  gcloud container --project "project-name" clusters create-auto "default-cluster" \
      --region "asia-southeast2" --release-channel "regular" \
      --network "projects/project-name/global/networks/default" \
      --subnetwork "projects/project-name/regions/asia-southeast2/subnetworks/default" \
      --cluster-ipv4-cidr "/17" --services-ipv4-cidr "/22" --scopes storage-rw
  
  ```
  
  (I generated this command using the Google Cloud web console, then added the `--scopes storage-rw` argument at the end.)
  
  But I still get a Snakemake error message related to lack of permission for Google Storage read-write:
  
  ```
  google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/kubernetes-nccs-npc2/o/whoami.txt?fields=name&prettyPrint=false: Caller does not have storage.objects.get access to the Google Cloud Storage object.
  
  ```
  
  It seems `--scopes storage-rw` does not work for the creation of autopilot clusters. Is this true? If so, how can I grant Google Storage read-write access to an autopilot cluster?
  
  **Tags:** kubernetes, google-cloud-platform, google-kubernetes-engine, google-cloud-storage
  
  > **Comments:**
  > **username_1**: were you able to find a solution?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-03-22. Score: 0
  
  I think the error has more to do with the service account permissions running your cluster. I'd make sure all the permissions are included, like *storage.ojjects.get*. The error seems very permissions related.
  
  ```
  Caller does not have storage.objects.get access to the Google Cloud Storage object.
  
  ```
  
  You might be hitting this issue Google has reported:  
  <https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes>
  
  I'd listen to their recommendations over mine.
  
  When managing IAM roles, you can treat a service account either as a resource or as an identity. This [command](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/get-iam-policy) is to get the iam policy of a service account resource. There are other gcloud commands to manage IAM policies for other types of resources. For example, to manage IAM policies on a project, use the $ gcloud projects commands and for services use $ gcloud iam service-accounts.
  
  This will return your service running the cluster w/ role assignment (it's the robot one :) )
  
  ```
  gcloud projects get-iam-policy <PROJECT-NAME> 
  
  ```
  
  The problem is sometimes running these commands requires special permissions too, so it becomes fools progress. I think this link may be helpful. it shows how to set permissions on a service-account.
  
  <https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding>
  
  Also here is Google dictionary of IAM permissions including
  *storage.ojjects.get*.
  
  <https://cloud.google.com/iam/docs/understanding-roles>
  
  
  ---
  
  