{"action":"opened","issue":{"url":"https://api.github.com/repos/weaveworks/launcher/issues/190","repository_url":"https://api.github.com/repos/weaveworks/launcher","labels_url":"https://api.github.com/repos/weaveworks/launcher/issues/190/labels{/name}","comments_url":"https://api.github.com/repos/weaveworks/launcher/issues/190/comments","events_url":"https://api.github.com/repos/weaveworks/launcher/issues/190/events","html_url":"https://github.com/weaveworks/launcher/issues/190","id":318917367,"number":190,"title":"GKE requires special IAM rights","user":{"login":"marccarre","id":836014,"avatar_url":"https://avatars0.githubusercontent.com/u/836014?v=4","gravatar_id":"","url":"https://api.github.com/users/marccarre","html_url":"https://github.com/marccarre","followers_url":"https://api.github.com/users/marccarre/followers","following_url":"https://api.github.com/users/marccarre/following{/other_user}","gists_url":"https://api.github.com/users/marccarre/gists{/gist_id}","starred_url":"https://api.github.com/users/marccarre/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marccarre/subscriptions","organizations_url":"https://api.github.com/users/marccarre/orgs","repos_url":"https://api.github.com/users/marccarre/repos","events_url":"https://api.github.com/users/marccarre/events{/privacy}","received_events_url":"https://api.github.com/users/marccarre/received_events","type":"User","site_admin":false},"labels":[{"id":810040749,"url":"https://api.github.com/repos/weaveworks/launcher/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-30T14:47:44Z","updated_at":"2018-04-30T14:47:44Z","closed_at":null,"author_association":"OWNER","body":"### Problem\r\n\r\nUnless you have `Kubernetes Engine Admin` (or at least more than `Kubernetes Engine Developer`) IAM role in GCP, installing the agent will fail with:\r\n\r\n```\r\n$ curl -Ls https://get.dev.weave.works | sh -s -- --token=... --gke\r\nDownloading the Weave Cloud installer...  \r\nPreparing for Weave Cloud setup\r\nChecking kubectl & kubernetes versions\r\nConnecting cluster to \"marc-test\" (id: dazzling-fog-16) on Weave Cloud\r\nInstalling Weave Cloud agents on gke_marcus-gke-test_us-central1-a_marc-test at https://23.236.57.225\r\nCould not create clusterrolebinding. GKE role \"Kubernetes Engine Admin\" (containers.admin) required to create resources.\r\nError from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User \"marc@weave.works\" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required \"container.clusterRoleBindings.create\" permission.\r\nFull output:\r\nError from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User \"marc@weave.works\" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required \"container.clusterRoleBindings.create\" permission.\r\n```\r\n\r\n### Potential solutions\r\n\r\n1. Add something like the below to the instructions:\r\n\r\n    - Go to console.cloud.google.com > \"_IAM & admin_\" > \"_IAM_\"\r\n    - Select your username > \"_Roles_\" > \"_Kubernetes Engine_\" > \"_Kubernetes Engine Admin_\"\r\n\r\n2. Create a tighter integration with GCP/GKE to do this automatically for the end-user, see also:\r\n\r\n    - weaveworks/service/issues/1645\r\n    - weaveworks/service/issues/1764\r\n    - weaveworks/service/issues/1765\r\n    - https://cloud.google.com/iam/reference/rest/v1/projects.roles/create"}}
{"actor":{"display_login":"marccarre"}}