-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New GCP project setup doesn't give correct kms permissions #31992
Comments
/sig testing |
Currently the test uses the default service account for GCE instead of a specific service account. I0212 20:46:57.674362 7020 setup_e2e_test.go:94] Running in project k8s-infra-e2e-boskos-067 with service account [email protected] The SA @mattcary Can you make sure all the tests use the SA |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
#31863 moved the pd csi driver to some new cluster and set of projects, however it was apparently never verified that those projects actually work to run the test.
The cluster service account is missing roles/cloudkms.cryptoKeyEncrypterDecrypter.
I think a change needs to be made to k8s.io/k8s.io/infra/gcp somewhere, but with the partial migration from bash to terraform I'm not sure what to change.
For now I'll revert the change that broke our e2e test; any suggestions on how to correctly set up the cluster service account in the terraform world are welcome!
The text was updated successfully, but these errors were encountered: