<p>I think the error has more to do with the service account permissions running your cluster.  I'd make sure all the permissions are included, like <em>storage.ojjects.get</em>.  The error seems very permissions related.</p>
<pre><code>Caller does not have storage.objects.get access to the Google Cloud Storage object.
</code></pre>
<p>You might be hitting this issue Google has reported:<br />
<a href="https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes</a></p>
<p>I'd listen to their recommendations over mine.</p>
<p>When managing IAM roles, you can treat a service account either as a resource or as an identity. This <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/get-iam-policy" rel="nofollow noreferrer">command</a> is to get the iam policy of a service account resource. There are other gcloud commands to manage IAM policies for other types of resources. For example, to manage IAM policies on a project, use the $ gcloud projects commands and for services use $ gcloud iam service-accounts.</p>
<p>This will return your service running the cluster w/ role assignment (it's the robot one :) )</p>
<pre><code>gcloud projects get-iam-policy &lt;PROJECT-NAME&gt; 
</code></pre>
<p>The problem is sometimes running these commands requires special permissions too, so it becomes fools progress.  I think this link may be helpful.  it shows how to set permissions on a service-account.</p>
<p><a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding" rel="nofollow noreferrer">https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding</a></p>
<p>Also here is Google dictionary of IAM permissions including
<em>storage.ojjects.get</em>.</p>
<p><a href="https://cloud.google.com/iam/docs/understanding-roles" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/understanding-roles</a></p>

CC BY-SA 4.0
2022-03-22T05:18:47.170Z
2022-03-22T05:26:31.240Z
2022-03-22T05:26:31.240Z
Personal Assistant
<p>I am trying to use the workflow orchestrator Snakemake with a Google Kubernetes Engine (GKE) <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview" rel="nofollow noreferrer">autopilot</a> cluster. My workflow needs to upload files to Google Cloud Storage buckets within the same project. Both <a href="https://snakemake.readthedocs.io/en/v7.2.1/executing/cloud.html#setup-kubernetes-on-google-cloud-engine" rel="nofollow noreferrer">Snakemake</a> and <a href="https://cloud.google.com/deep-learning-containers/docs/kubernetes-container" rel="nofollow noreferrer">GKE documentations</a> specify that a Google Storage read-write scope should be specified when the cluster is created, via <code>--scopes storage-rw</code>.</p>
<p>I tried doing so with an autopilot cluster:</p>
<pre><code>gcloud container --project &quot;project-name&quot; clusters create-auto &quot;default-cluster&quot; \
    --region &quot;asia-southeast2&quot; --release-channel &quot;regular&quot; \
    --network &quot;projects/project-name/global/networks/default&quot; \
    --subnetwork &quot;projects/project-name/regions/asia-southeast2/subnetworks/default&quot; \
    --cluster-ipv4-cidr &quot;/17&quot; --services-ipv4-cidr &quot;/22&quot; --scopes storage-rw
</code></pre>
<p>(I generated this command using the Google Cloud web console, then added the <code>--scopes storage-rw</code> argument at the end.)</p>
<p>But I still get a Snakemake error message related to lack of permission for Google Storage read-write:</p>
<pre><code>google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/kubernetes-nccs-npc2/o/whoami.txt?fields=name&amp;prettyPrint=false: Caller does not have storage.objects.get access to the Google Cloud Storage object.
</code></pre>
<p>It seems <code>--scopes storage-rw</code> does not work for the creation of autopilot clusters. Is this true? If so, how can I grant Google Storage read-write access to an autopilot cluster?</p>

CC BY-SA 4.0
2022-11-23T22:44:50.323Z
were you able to find a solution?
Mohsin
<kubernetes><google-cloud-platform><google-kubernetes-engine><google-cloud-storage>
Google Kubernetes Engine's auto-pilot mode does not grant nodes Google Storage write access
ning
# Google Kubernetes Engine's auto-pilot mode does not grant nodes Google Storage write access

(Asked by: username_0 on 2022-03-18)

I am trying to use the workflow orchestrator Snakemake with a Google Kubernetes Engine (GKE) autopilot cluster. My workflow needs to upload files to Google Cloud Storage buckets within the same project. Both Snakemake and GKE documentations specify that a Google Storage read-write scope should be specified when the cluster is created, via --scopes storage-rw.
I tried doing so with an autopilot cluster:
gcloud container --project "project-name" clusters create-auto "default-cluster" \
    --region "asia-southeast2" --release-channel "regular" \
    --network "projects/project-name/global/networks/default" \
    --subnetwork "projects/project-name/regions/asia-southeast2/subnetworks/default" \
    --cluster-ipv4-cidr "/17" --services-ipv4-cidr "/22" --scopes storage-rw

(I generated this command using the Google Cloud web console, then added the --scopes storage-rw argument at the end.)
But I still get a Snakemake error message related to lack of permission for Google Storage read-write:
google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/kubernetes-nccs-npc2/o/whoami.txt?fields=name&prettyPrint=false: Caller does not have storage.objects.get access to the Google Cloud Storage object.

It seems --scopes storage-rw does not work for the creation of autopilot clusters. Is this true? If so, how can I grant Google Storage read-write access to an autopilot cluster?

**Tags:** kubernetes, google-cloud-platform, google-kubernetes-engine, google-cloud-storage

> **Comments:**
> **username_1**: were you able to find a solution?  

---

## 1 answers

### Answer by username_2 on 2022-03-22. Score: 0

I think the error has more to do with the service account permissions runusername_0 your cluster.  I'd make sure all the permissions are included, like storage.ojjects.get.  The error seems very permissions related.
Caller does not have storage.objects.get access to the Google Cloud Storage object.

You might be hitting this issue Google has reported:
https://cloud.google.com/kubernetes-engine/docs/how-to/access-scopes
I'd listen to their recommendations over mine.
When managing IAM roles, you can treat a service account either as a resource or as an identity. This command is to get the iam policy of a service account resource. There are other gcloud commands to manage IAM policies for other types of resources. For example, to manage IAM policies on a project, use the $ gcloud projects commands and for services use $ gcloud iam service-accounts.
This will return your service runusername_0 the cluster w/ role assignment (it's the robot one :) )
gcloud projects get-iam-policy  

The problem is sometimes runusername_0 these commands requires special permissions too, so it becomes fools progress.  I think this link may be helpful.  it shows how to set permissions on a service-account.
https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding
Also here is Google dictionary of IAM permissions including
storage.ojjects.get.
https://cloud.google.com/iam/docs/understanding-roles


---

