IssueTracker

Information redacted by Android Beta Feedback.

Please upgrade to the latest release from the link Beta3.1.

If the issue still persists, please capture the new bug report and share it here.

Please provide the requested information to proceed further. Unfortunately the issue will be closed within 7 days if there is no further update.

(Between the 24 hour wait and misreading a section of the docs on this page https://cloud.google.com/iam/docs/understanding-roles#predefined, I misattributed the cause of the error.)

Correction/Clarification of bug:

1. Create a service account with roles/container.defaultNodeServiceAccount
2. Find the service account's uniqueID, by running something like this:
   gcloud iam service-accounts describe gmp-test-sa@chrism-playground-369416.iam.gserviceaccount.com | grep uniqueId
3. Create a GKE nodepool with the nodepool's GCP service account set to the uniqueId of the service account.
   (The node's IAM rights will function correctly, but the warning in the title will come up as a false positive.)
4. The bug is that the check is too basic:
   • It fails when your GKE nodepool's GCP service account is set to the email of the service account + roles/container.defaultNodeServiceAgent (This is technically an incorrect failure, because roles/container.defaultNodeServiceAgent is equal to roles/container.defaultNodeServiceAccount just with 1 extra permission, so there's no permissions missing.) (That said the false positive error message is fine in this scenario, given roles/container.defaultNodeServiceAgent is a legacy role intended to be replaced by roles/container.defaultNodeServiceAccount. Plus following the documented instructions fixes the issue)
   • The second failure is more problematic. If you have a GCP SA with roles/container.defaultNodeServiceAccount (which is correct), and attach it to a nodepool using it's uniqueID, the check logic will fail and say you don't have roles/container.defaultNodeServiceAccount attached when it is, and then the docs aren't helpful, thus my statement of problematic. (Fix would be to either update the check logic to check for the scenario of attaching service account with correct IAM role by uniqueId. Or update the docs to say If you see this error when you have the correct role attached to the service account, check if you've attached the service account to your nodepool using uniqueId, if so replace it with the email reference of the service account.)
5. I was able to get the error to go away when I recreated the nodepool to use the email reference of the service account instead of the uniqueId.

Also feature request:

1. Can a method to manually trigger the GKE Notification to update be implemented?
   (Otherwise whenever one needs to debug it they need to wait 24 hours between iterations.)