We have been working for some months in creating an internal network across all our projects in Google Cloud by using SharedVPC and we have encountered no problems whatsoever while setting up compute instances under the different subnetworks assigned to each project.
The problem, however, has appeared when we try to create a Kubernetes cluster. For some reason, when we try to do so we obtain the following error:
Error 403: Google Compute Engine: Required 'compute.networks.get' permission for 'projects/host-project/global/networks/subnet-required'
I checked that all the proper permissions were in place as described in Google's GKE using SharedVPC example documentation, and even reenabled the APIs and set up the permissions suggested in the documentation from scratch. Still, it seems that the problem persists.
The command used to try to deploy the cluster is:
gcloud container clusters create test \ --project <target-project> \ --zone=us-east1-c \ --enable-ip-alias \ --network projects/<host-project>/global/networks/<vpc-network> \ --subnetwork projects/<host-project>/regions/us-east1/subnetworks/<subnet-required> \ --cluster-secondary-range-name k8s-cluster-range \ --services-secondary-range-name k8s-services-range
Container Engine and Compute Engine API service accounts have been granted roles/compute.networkUser and roles/container.hostServiceAgentUser as in the documentation.
Has anyone found this problem or know what can be causing this error?