service role/resourceMetadata.writer missing

[c4m4]

the pod agent stackdriver-metadata-agent-cluster-level in kube-system namespace sometimes crash because doesn't has any permissions to write the metadata:

kubectl logs -n kube-system stackdriver-metadata-agent-cluster-level-f9544fdbd-cmxht -c metadata-agent

I0402 12:37:25.110888       1 binarylog.go:265] rpc: flushed binary log to ""
W0402 12:37:55.503160       1 kubernetes.go:118] Failed to publish resource metadata: rpc error: code = PermissionDenied desc = The caller does not have permission
I0402 12:38:24.316933       1 trace.go:898] Failed loading config; disabling tracing: open /export/hda3/trace_data/trace_config.proto: no such file or directory
I0402 12:38:25.111159       1 binarylog.go:265] rpc: flushed binary log to ""
W0402 12:38:55.902556       1 kubernetes.go:118] Failed to publish resource metadata: rpc error: code = PermissionDenied desc = The caller does not have permission
I0402 12:39:25.111479       1 binarylog.go:265] rpc: flushed binary log to ""
W0402 12:39:56.204656       1 kubernetes.go:118] Failed to publish resource metadata: rpc error: code = PermissionDenied desc = The caller does not have permission
I0402 12:40:25.113399       1 binarylog.go:265] rpc: flushed binary log to ""
W0402 12:40:56.501828       1 kubernetes.go:118] Failed to publish resource metadata: rpc error: code = PermissionDenied desc = The caller does not have permission
I0402 12:41:25.113751       1 binarylog.go:265] rpc: flushed binary log to ""

[bharathkkb]

I believe this might be an issue due to lack of these particular permissions

• logging.logEntries.create
• monitoring.metricDescriptors.list
• monitoring.timeSeries.create

I will try to recreate and possibly fix. Feel free to open a PR if you get around to it first.

[bharathkkb]

I was able to recreate this issue and the fix turned out to be just adding this role roles/stackdriver.resourceMetadata.writer as recommended at the bottom of this page. I will add this as part of the service account creation.

roles/stackdriver.resourceMetadata.writer: In the Google Cloud Console, this role is named Stackdriver Resource Metadata Writer. This role permits write-only access to resource metadata, and it provides exactly the permissions needed by agents to send metadata.

[sephethus]

What account needs these permissions?

[c4m4]

@sephethus ff17c5b