<p>I’m trying to create a cluster in GKE project-1 with shared network of project-2.</p>
<p>Roles given to Service account:<br />
project-1: Kubernetes Engine Cluster Admin, Compute Network Admin, Kubernetes Engine Host Service Agent User<br />
project-2: Kubernetes Engine Service Agent, Compute Network User, Kubernetes Engine Host Service Agent User</p>
<p>Service Account is created under project-1.
API &amp; Services are enabled in both Projects.</p>
<p>But I am getting this error persistently.
Error: googleapi: Error 403: Kubernetes Engine Service Agent is missing required permissions on this project. See Troubleshooting  |  Kubernetes Engine Documentation  |  Google Cloud for more info: required “container.hostServiceAgent.use” permission(s) for “projects/project-2”., forbidden</p>
<pre><code>data &quot;google_compute_network&quot; &quot;shared_vpc&quot; {
    name = &quot;network-name-in-project-2&quot;
    project = &quot;project-2&quot;
}

 
data &quot;google_compute_subnetwork&quot; &quot;shared_subnet&quot; {
    name = &quot;subnet-name-in-project-2&quot;
    project = &quot;project-2&quot;
    region = &quot;us-east1&quot;
}

 # cluster creation under project 1
 # project 1 specified in Provider 
resource &quot;google_container_cluster&quot; &quot;mowx_cluster&quot; {
    name = var.cluster_name
    location = &quot;us-east1&quot;
    initial_node_count = 1
 
    master_auth {
        username = &quot;&quot;
        password = &quot;&quot;
 
        client_certificate_config {
            issue_client_certificate = false
        }
    }
 
    remove_default_node_pool = true
    cluster_autoscaling {
        enabled = false
    }
 
    # cluster_ipv4_cidr = var.cluster_pod_cidr
    ip_allocation_policy {
        cluster_secondary_range_name = &quot;pods&quot;
        services_secondary_range_name = &quot;svc&quot;
    }
 
    network = data.google_compute_network.shared_vpc.id
    subnetwork = data.google_compute_subnetwork.shared_subnet.id
}
</code></pre>

xyphan
<p>This is a community wiki answer based on the discussion in the comments and posted for better visibility. Feel free to expand it.</p>
<p>The error you encountered:</p>
<pre><code>Error: googleapi: Error 403: Kubernetes Engine Service Agent is missing required permissions on this project. See Troubleshooting | Kubernetes Engine Documentation | Google Cloud for more info: required “container.hostServiceAgent.use” permission(s) for “projects/project-2”., forbidden
</code></pre>
<p>means that the necessary service agent was not created:</p>
<p><code>roles/container.serviceAgent</code> - Kubernetes Engine Service Agent:</p>
<blockquote>
<p>Gives Kubernetes Engine account access to manage cluster resources.
Includes access to service accounts.</p>
</blockquote>
<p>The official <a href="https://cloud.google.com/kubernetes-engine/docs/troubleshooting#gke_service_account_deleted" rel="nofollow noreferrer">troubleshooting docs</a> describe a solution for such problems:</p>
<blockquote>
<p>To resolve the issue, if you have removed the <code>Kubernetes Engine Service Agent</code> role from your Google Kubernetes Engine service account,
add it back. Otherwise, you must re-enable the Kubernetes Engine API,
which will correctly restore your service accounts and permissions.
You can do this in the gcloud tool or the Cloud Console.</p>
</blockquote>
<p>The solution above works as in your use case the account was missing so it had to be (re)created.</p>
