cannot connect to GKE cluster using dns-endpoint

Google Cloud Serverless Applications
,
1

I have a private GKE cluster set up with dns-endpoint enabled and I am project owner in this GCP project, I used this command to get kubeconfig entry first, but I cannot connect to GKE. Any idea?

gcloud container clusters get-credentials cluster-xxx --region us-central1 --project project1 --dns-endpoint

Fetching cluster endpoint and auth data.
kubeconfig entry generated for cluster-xxx

kubectl get all -n my-test-namespace

E1213 12:18:21.866477 31297 memcache.go:265] couldn’t get current server API group list: Permission ‘container.googleapis.com/clusters.connect’ denied on resource ‘gke-d70e9e966917459997c6xxxxxx-12345678.us-central1.gke.goog’ (or it may not exists

Since I am a project owner, I should have “roles/container.developer” equivalent permission, why I still cannot connect to the cluster, what do I miss here. Thanks for your help!

2

Hi lizchen,

Welcome to Google Cloud Community!

Based on this documentation, by default the roles/container.developer are not applied even if you already have the project owner role. It is required to configure a new IAM permission container.clusters.connect and assign one of the following IAM roles:

  • roles/container.developer
  • roles/container.viewer

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

1 Like