Error applying IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':
Error setting IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':
googleapi: Error 403: Permission iam.serviceAccounts.setIamPolicy is required to perform this
operation on service account SERVICE_ACCOUNT., forbidden
Error when reading or editing Container Cluster "cluster": googleapi:
Error 403: Required "container.clusters.get" permission(s) for "..."., forbidden
Error reading instance group manager returned as an instance group URL:
"googleapi: Error 403: Required 'compute.instanceGroupManagers.get' permission
for '...', forbidden"
ERROR: (gcloud.eventarc.triggers.create) Invalid resource state for projects/PROJECT_ID/locations/LOCATION/triggers/TRIGGER_ID.
Ensure that you have enabled your GKE destination and assigned required permissions to the service account.
For more information, see https://cloud.google.com/eventarc/standard/docs/gke/troubleshooting.
[[["์ดํดํ๊ธฐ ์ฌ์","easyToUnderstand","thumb-up"],["๋ฌธ์ ๊ฐ ํด๊ฒฐ๋จ","solvedMyProblem","thumb-up"],["๊ธฐํ","otherUp","thumb-up"]],[["์ดํดํ๊ธฐ ์ด๋ ค์","hardToUnderstand","thumb-down"],["์๋ชป๋ ์ ๋ณด ๋๋ ์ํ ์ฝ๋","incorrectInformationOrSampleCode","thumb-down"],["ํ์ํ ์ ๋ณด/์ํ์ด ์์","missingTheInformationSamplesINeed","thumb-down"],["๋ฒ์ญ ๋ฌธ์ ","translationIssue","thumb-down"],["๊ธฐํ","otherDown","thumb-down"]],["์ต์ข ์ ๋ฐ์ดํธ: 2025-09-03(UTC)"],[[["\u003cp\u003eThis document provides troubleshooting steps for issues encountered when using Eventarc for GKE, covering common errors and their solutions.\u003c/p\u003e\n"],["\u003cp\u003eTrigger creation failures often stem from incorrect Eventarc service account permissions, missing GKE clusters, or Workload Identity Federation not being enabled on the target cluster.\u003c/p\u003e\n"],["\u003cp\u003eIf a trigger is created successfully but events aren't delivered, check for Pub/Sub message drops by implementing a retry policy or dead-letter queue and examine the event forwarder's status.\u003c/p\u003e\n"],["\u003cp\u003eEnsure that GKE destinations are enabled and that the Eventarc service account has been granted the necessary roles and permissions to manage events.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA products are available "as is" and might have limited support.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot Eventarc for Google Kubernetes Engine (GKE)\n\n[Standard](/eventarc/standard/docs/overview)\n|\n| **Preview**\n|\n|\n| This product is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page shows you how to resolve issues that you might encounter when using\nEventarc for GKE, including the public\nendpoints of private and public services running in a GKE\ncluster.\n\nFor other issues that you might also encounter, refer to troubleshooting for:\n\n- [Issues common to all destinations](/eventarc/docs/troubleshooting)\n- [Eventarc for Cloud Run](/eventarc/standard/docs/run/troubleshoot)\n- [Eventarc for Workflows](/eventarc/standard/docs/workflows/troubleshoot)\n\nTrigger creation fails with resource creation permission errors\n---------------------------------------------------------------\n\nYou receive error messages similar to one of the following: \n\n```\nError applying IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':\nError setting IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':\ngoogleapi: Error 403: Permission iam.serviceAccounts.setIamPolicy is required to perform this\noperation on service account SERVICE_ACCOUNT., forbidden\n```\n\n\u003cbr /\u003e\n\n```\nError when reading or editing Container Cluster \"cluster\": googleapi:\nError 403: Required \"container.clusters.get\" permission(s) for \"...\"., forbidden\n``` \n\n```\nError reading instance group manager returned as an instance group URL:\n\"googleapi: Error 403: Required 'compute.instanceGroupManagers.get' permission\nfor '...', forbidden\"\n```\n\nThis error occurs when you have not correctly set up the Eventarc\nservice account that is required by Eventarc to manage\nresources in the Google Kubernetes Engine (GKE) cluster.\n\nTo resolve the issue, ensure that the Eventarc service account\nhas been configured correctly with the appropriate permissions to create resources.\nFor more information, follow the instructions for a\n[specific provider, event type, and GKE destination](/eventarc/standard/docs/event-providers-targets#triggers).\n\nTrigger creation fails because target cluster cannot be found or does not have Workload Identity Federation for GKE enabled\n---------------------------------------------------------------------------------------------------------------------------\n\nYou receive error messages similar to one of the following: \n\n```\nERROR: (gcloud.eventarc.triggers.create) NOT_FOUND: Not found: projects/PROJECT_ID/locations/\nLOCATION/clusters/CLUSTER_NAME.\n...\n``` \n\n```\nERROR: (gcloud.eventarc.triggers.create) INVALID_ARGUMENT: workload identity is not enabled on\ncluster CLUSTER_NAME in LOCATION\n...\n```\n\nThis error occurs when Eventarc cannot find the target\nGKE cluster or the cluster does not have Workload Identity Federation for GKE\nenabled.\n\nTo resolve the issue, ensure that the target cluster exists and has\n[Workload Identity enabled](/kubernetes-engine/docs/how-to/workload-identity).\n\nTrigger creation fails because of invalid resource state\n--------------------------------------------------------\n\nYou receive an error message similar to the following for your project: \n\n```\nERROR: (gcloud.eventarc.triggers.create) Invalid resource state for projects/PROJECT_ID/locations/LOCATION/triggers/TRIGGER_ID.\nEnsure that you have enabled your GKE destination and assigned required permissions to the service account.\nFor more information, see https://cloud.google.com/eventarc/standard/docs/gke/troubleshooting.\n```\n\nThis error occurs when:\n\n- Your GKE destination hasn't been enabled.\n- The service account has not been granted the required roles and permissions that enables Eventarc to manage events for GKE destinations.\n\n\u003cbr /\u003e\n\nTo resolve this issue:\n\n1. Ensure that you have enabled GKE destinations: \n\n ```bash\n gcloud eventarc gke-destinations init\n ```\n For more information, follow the instructions for a [specific provider and event type](/eventarc/standard/docs/event-providers-targets#triggers) in the \"Enable GKE destinations\" section.\n2. Ensure that the Eventarc service account has been configured with the appropriate permissions to create resources. For more information on how to grant the appropriate roles to the service account, follow the instructions for a [specific provider and event type](/eventarc/standard/docs/event-providers-targets#triggers) in the \"Prepare to create a trigger\" section.\n3. If the error persists, [contact support](/eventarc/docs/getting-support).\n\nTrigger is created successfully but target is not receiving events\n------------------------------------------------------------------\n\nCheck that enough time has elapsed since creating the trigger. It can take up to\ntwo minutes before events are sent.\n\n1. If events are not being delivered at the target, events sent from\n Pub/Sub to the target might be getting dropped:\n\n To ensure that events aren't dropped, set up a\n [Pub/Sub subscription retry policy](/pubsub/docs/handling-failures#subscription_retry_policy)\n or [forward undelivered messages to a dead-letter topic](/pubsub/docs/handling-failures#forwarding_to)\n (also known as a dead-letter queue).\n\n Before setting the dead-letter topic, retrieve the trigger's topic and subscription: \n\n ```bash\n gcloud eventarc triggers describe TRIGGER \\\n --location=LOCATION\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eTRIGGER\u003c/var\u003e: the ID of the trigger or a fully qualified identifier.\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of the Eventarc trigger.\n2. If the trigger still doesn't work, check the status of Eventarc's\n event forwarder component to see if it has been deployed properly:\n\n 1. Identify the cluster namespaces by listing all pods that have `event-forwarder` in their name: \n\n ```bash\n kubectl get pods --all-namespaces | grep event-forwarder\n ```\n The output is similar to the following: \n\n ```\n event-forwarder-namespace-hash1 event-forwarder-hash1 1/1 Running 0 5d2h\n event-forwarder-namespace-hash2 event-forwarder-hash2 1/1 Running 0 2d2h\n ```\n The first 30 characters of the namespaces should match the name of the Eventarc trigger you created, followed by a hash to disambiguate any triggers with the same initial 30 characters.\n 2. Retrieve the deployment details: \n\n ```bash\n kubectl get deployments -n EVENT_FORWARDER_NAMESPACE event-forwarder\n ```\n 3. Retrieve the pod details: \n\n ```bash\n kubectl describe pod -n EVENT_FORWARDER_NAMESPACE EVENT_FORWARDER_HASH\n ```\n 4. Print the pod logs to investigate why or where the failure has occurred: \n\n ```bash\n kubectl logs -f -n EVENT_FORWARDER_NAMESPACE EVENT_FORWARDER_HASH\n ```\n For example, in the following log, the service account has had the `Pub/Sub Subscriber` role revoked: \n\n ```\n {\"error\":\"generic::permission_denied: missing 'pubsub.subscriptions.consume' permission\",\n \"message\":\"Permissions check failed\",\"severity\":\"fatal\",\"timestamp\":\"2021-07-07T14:57:49.038877483Z\"}\n ```\n\nRelated information\n-------------------\n\n- Learn more about [Eventarc for GKE](/eventarc/standard/docs/overview#gke).\n- To get additional help, see [Get support](/eventarc/docs/getting-support)."]]
