<p>I am getting an error message after running some kubectl commands (GCP command line - gcloud). I have a K8S cluster created in GKE.</p>

<p>Example:</p>

<blockquote>
  <p>kubectl describe node</p>
</blockquote>

<p><strong><em>gke_k8s_cluster_name
Error from server (Forbidden): leases.coordination.k8s.io "gke_k8s_cluster_name" is forbidden: User "MY_SERVICE_ACCOUNT" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "kube-node-lease": Required "container.leases.get" permission.</em></strong></p>

<p>The point is that "container.leases.get" permission is not listed in IAM (as custom permissions or regular role).</p>

<p>How could I grant that permission to the service account in GCP ?</p>

<p>thanks,
Jose</p>

José Enrique Hernández
<p>You may need to grant additional permissions to yourself on GCP IAM and GKE sides, for example:</p>

<pre><code>PROJECT_ID=$(gcloud config get-value core/project)
USER_ID=$(gcloud config get-value core/account)
gcloud projects add-iam-policy-binding ${PROJECT_ID} --member=user:${USER_ID} --role=roles/container.admin
kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user ${USER_ID}
</code></pre>

<p>See also <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/iam" rel="nofollow noreferrer">GCP IAM &amp; GKE RBAC integration</a>.</p>
