<p>Maybe I'm just a bit confused, but basically I'm trying to establish my workflow with using the <code>gcloud</code> cli through my own host (Mac) terminal rather than the provided gcloud interactive shell.</p>

<p>I'm authenticating with an IAM member by running:</p>

<p><code>gcloud auth login</code></p>

<p>It takes me to the Google Cloud login page, which I successfully authenticate with and then I get the following in my shell:</p>

<pre><code>You are now logged in as [MY_EMAIL@gmail.com].
Your current project is [myproperty-1537056464248].  You can change this setting by running:

  $ gcloud config set project PROJECT_ID
</code></pre>

<p>After this, I try to issue the following command:</p>

<pre><code>gcloud container clusters create somename
</code></pre>

<p>And I get the following error message:</p>

<pre><code>ERROR: (gcloud.container.clusters.create) ResponseError: code=400, message=Project "myproperty-1537056464248" has no network named "default".
</code></pre>

<p>My IAM user has the following roles:</p>

<ul>
<li><code>Kubernetes Engine Cluster Admin</code></li>
<li><code>Owner</code></li>
</ul>

<p>All I want to do is avoid using the gcloud interactive shell so I can:</p>

<ol>
<li>Create clusters through the command line</li>
<li>Push docker builds to the Google Container Registry</li>
<li>List clusters</li>
<li>Create pods</li>
<li>etc...</li>
</ol>

<p>But these IAM policies aren't really working how I expect.</p>

<p>Should I be using a service account instead?</p>

<p>You hit two distinct errors:</p>

<ol>
<li>The 1st error message says your project is missing the 'default' network.</li>
</ol>

<p>You can check your project's networks with:</p>

<pre><code>$ gcloud compute networks list
NAME     SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4
default  AUTO         REGIONAL
</code></pre>

<p>If you create a fully new project it should have a 'default' network.</p>

<p>Or you can specify an existing network with:</p>

<pre><code>gcloud container clusters create somename --network=put-existing-network-here
</code></pre>

<ol start="2">
<li>The 2nd error is lack of permission 'compute.networks.get' in the project. </li>
</ol>

<p>You can verify the actual roles in the project by using 'gcloud projects get-iam-policy PROJECT_ID'. Look for the role 'owner' for your IAM user, like this:</p>

<pre><code>$ gcloud projects get-iam-policy PROJECT_ID
- members:
  - user:username@somedomain.com
  role: roles/owner
</code></pre>
