403 while deploying the go example on Cloudrun GKE about berglas

[sethvargo]

Well - it should be 😄

[sethvargo]

Hi @PapaStan

You should be able to use Berglas with Cloud Run for Anthos with v0.4.0+. Make sure your underlying node pools have the cloud-platform scope (the default is less).

[sethvargo]

What permissions does your GKE cluster node service account have? Have you enabled workload identity?

[PapaStan]

Thank you for your quick reply,

After enabling and using Workload Identity, I'm facing another error:

failed to resolve environment variables: failed to find environment variables: failed to communicate with cloud run: {
    "error": {
        "code": 400,
        "message": "The request has errors",
        "status": "INVALID_ARGUMENT",
        "details": [
            {
                "@type": "type.googleapis.com/google.rpc.BadRequest",
                "fieldViolations": [
                    {
                        "field": "region",
                        "description": "Unsupported region europe-west4"
                    }
                ]
            }
        ]
    }
}

Is berglas using region-locked features?

[sethvargo]

It uses the regional endpoint to lookup environment variables. You can run berglas with -local and it wont try to contact the API. I haven't tested it with Cloud Run on Anthos because I presumed folks would just use the native Kubernetes stuff instead.

[PapaStan]

Ok, I'm closing the issue as CloudRun on Anthos is not supported.
Thank you for your time

[PapaStan]

With the --local flag:

failed to access secret project-id/tls-key: failed to access secret: failed to decrypt dek: rpc error: code = PermissionDenied desc = Request had insufficient authentication scopes.

It looks like the cluster's service account (number[email protected]) is not used by berglas.