Create cluster with Shared Network in GKE

Terraform Providers Google
1

I’m trying to create a cluster in GKE project-1 with shared network of project-2.

Roles given to Service account:
project-1: Kubernetes Engine Cluster Admin, Compute Network Admin
project-2: Kubernetes Engine Service Agent, Compute Network User

Service Account is created under project-1.
API & Services are enabled in both Projects.

But I am getting this error persistently.
Error: googleapi: Error 403: Kubernetes Engine Service Agent is missing required permissions on this project. See Troubleshooting  |  Google Kubernetes Engine (GKE)  |  Google Cloud for more info: required “container.hostServiceAgent.use” permission(s) for “projects/project-2”., forbidden

data "google_compute_network" "shared_vpc" {
    name = "network-name-in-project-2"
    project = "project-2"
}

 
data "google_compute_subnetwork" "shared_subnet" {
    name = "subnet-name-in-project-2"
    project = "project-2"
    region = "us-east1"
}

 # cluster creation under project 1
 # project 1 specified in Provider 
resource "google_container_cluster" "mowx_cluster" {
    name = var.cluster_name
    location = "us-east1"
    initial_node_count = 1
 
    master_auth {
        username = ""
        password = ""
 
        client_certificate_config {
            issue_client_certificate = false
        }
    }
 
    remove_default_node_pool = true
    cluster_autoscaling {
        enabled = false
    }
 
    # cluster_ipv4_cidr = var.cluster_pod_cidr
    ip_allocation_policy {
        cluster_secondary_range_name = "pods"
        services_secondary_range_name = "svc"
    }
 
    network = data.google_compute_network.shared_vpc.id
    subnetwork = data.google_compute_subnetwork.shared_subnet.id
}
2

Hi, did you resolve the issue. Even I am facing the same issue

3

You’re getting this error because the Kubernetes Engine Service Agent from your client project (project-1) doesn’t have permission to access shared resources (like network or PVC) in your host project (project-2). To fix this, you need to grant the required IAM role from the host project to the service account of the client project.

  1. Get the project number of your client project (project-1):

    gcloud projects describe project-1 --format='value(projectNumber)'

  2. Then grant the required role to that service account on your host project (project-2):

    gcloud projects add-iam-policy-binding project-2 \
  --member="serviceAccount:service-<CLIENT_PROJECT_NUMBER>@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/container.hostServiceAgentUser"

  3. Depending on your setup (e.g., if you’re using Shared VPC or other shared resources), you might also need to grant additional roles such as:

    • roles/compute.networkUser

    • roles/container.serviceAgent

After applying these roles, try creating the cluster again.
It should resolve the required "container.hostServiceAgent.use" permission error between project-1 and project-2.