Script ./gke/provision-gke.sh have mentioned parameter as --identity-namespace which need to be corrected to --identity-provider. Please correct as entire process keep on failing.

I am using trial version of google cloud console with anthos enabled. When configuring anthos config management, i am getting AccessDeniedException.

Command Ran : gsutil cp gs://config-management-release/released/latest/config-management-operator.yaml config-management-operator.yaml

Exception : AccessDeniedException: 403 [email protected] does not have storage.objects.list access to config-management-release.

Tried by creating new service account. But throws same exception. I configured service account using gcloud command line utility

Below are the roles associated with serviceaccount:

• roles/composer.environmentAndStorageObjectAdmin
• roles/compute.admin
• roles/compute.loadBalancerAdmin
• roles/compute.networkAdmin
• roles/compute.securityAdmin
• roles/container.admin
• roles/container.clusterAdmin
• roles/container.clusterViewer
• roles/editor
• roles/gkehub.admin
• roles/gkehub.connect
• roles/gkehub.viewer
• roles/iam.securityAdmin
• roles/iam.serviceAccountAdmin
• roles/iam.serviceAccountKeyAdmin
• roles/iam.serviceAccountTokenCreator
• roles/iam.serviceAccountUser
• roles/logging.admin
• roles/logging.configWriter
• roles/logging.viewer
• roles/monitoring.admin
• roles/owner
• roles/redis.admin
• roles/resourcemanager.projectIamAdmin
• roles/servicenetworking.networksAdmin
• roles/stackdriver.accounts.editor
• roles/storage.admin
• roles/storage.objectAdmin
• roles/storage.objectViewer
• roles/viewer

--identity-namespace is no longer a valid option, so the gke provisioning keeps failing.
It is replaced with --workload-pool

Version gives Unsupported GKE Version error.

Possibly don't specify version and just use GKE default to avoid this in future?

Hello!

First of all, I'm not sure of what sort of tagging you're using on this Github, and it is definitely not the best place to ask, but the discussion on Stackoverflow seems to be leading nowhere.

I'm writing this issue because after testing out the GKE Connect section of this workshop, the agent seems to be running fine and the gcloud membership command lists my cluster as registered; however, I'm unable to see my cluster on the GCP > Kubernetes Engine clusters list.

All my tests are documented on the Stackoverflow question, but I'd love if you could tell me what the whitelisted service account is and whether there's any difference between that and a newly created SA with proper permissions (gkehub.connect in this case).

Thanks for your time!

Edit: please let me know if you need me to reformat the question into some structured guideline or anything, I've not been able to find anything about question/issue format within the repo.
Edit 2: This is the one "tutorial" I've been following.

After version 268.0.0 (2019-10-22), gcloud SDK changed its parameters from "register-cluster" to "memberships register". This breaks walkthough-workshop.sh

After running the bootstrap scripts on Configuring GKE for Multi-Cluster Operation with Istio lab - the GKE cluster creation fails. The logs on the workDir reported the following:

###
### Begin Provision GKE
###
Creating cluster...
ERROR: (gcloud.beta.container.clusters.create) unrecognized arguments: --identity-namespace=qwiklabs-gcp-00-697400
0201df.svc.id.goog (did you mean '--identity-provider'?)
To search the help text of gcloud commands, run:
  gcloud help -- SEARCH_TERMS

Provisioning of the remote cluster also reported some weird errors:

Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 3
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 4
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 5
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 6
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 7
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 8
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 9
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 10
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 11
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 12
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 13
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 14
Cannot load kubecfg settings for "remote.k8s.local": context "remote.k8s.local" does not exist
Check if cluster is ready - Attempt 15

In this line the deployment script tries to run helm init, however, there's no such command in Helm 3 that is by default installed to Cloud Shell machine, therefore the script freezes waiting for CRDs to be installed and that is not going to happen ever.

Here's the Cloud Chell console recap of trying to run this lab in QwikLabs.

During execution of ./bootstrap-workshop.sh it hangs up on installation of istio on remote cluster. The issue is missing tiller service account. Workaround described here helm/helm#6374

Is the remote cluster set to export Stackdriver Monitoring information?

(In particular I have an alert on total Anthos CPU's in use and the count of remote CPU's is not being included.)

There seems to be an error in the MD5 Hash:

Cluster.kops "remote.k8s.local" not found
Create kops cluster...
I0129 10:14:33.801998    1320 create_cluster.go:519] Inferred --cloud=gce from zone "us-central1-a"
$l/config: googleapi: Error 400: Provided MD5 hash "1B2M2Y8AsgTpgAmY7PhCfg==" doesn't match calculated MD5 hash "aP2excWSm858AztEo1StmA=="., invalid 

error writing updated configuration: error writing Cluster "remote.k8s.local": error writing configuration file gs://democol-adk-prod-kops-remote/remote.k8s.local/config
error: cannot locate context remote.k8s.local
Check if cluster is ready - Attempt 1

Ref.

Is OPERATOR_YAML_LOCATION required? I grepped the files in this repo and don't see any other use of this variable.

I have a whitelisted anthos project and attempting to run the workshop.
I don't have access to gs://anthos-workshop/cfg-op-loc so had to comment this out to proceed.

Anthos Config Management appears to run Ok with this env var commented out.