google-cloud-platform - PROVISION 任务在 REQUESTING_CREATE 状态下失败

Question

我是 GCP 平台的新手，正在尝试创建一个简单的数据融合工作流程，以从驻留在 GCS 存储桶中的文本文件加载 BigQuery 表。

工作流程已成功部署。但是，在运行工作流时，它在步骤 2 中失败并出现错误语句

PROVISION task failed in REQUESTING_CREATE state for program run program_run:default.testing_df.-SNAPSHOT.workflow.DataPipelineWorkflow.5ff986e9-7241-11e9-af46-56bbe5c7844b.

在下面的详细日志中，我们有“'projects/mylab-gcp'必需的'compute.firewalls.list'权限”语句

以下是执行的完整错误日志。

2019-05-09 10:01:13,945 - DEBUG [provisioning-service-7:i.c.c.i.p.t.ProvisioningTask@121] - Executing PROVISION subtask REQUESTING_CREATE for program run program_run:default.testing_df.-SNAPSHOT.workflow.DataPipelineWorkflow.5ff986e9-7241-11e9-af46-56bbe5c7844b. 2019-05-09 10:01:16,839 - INFO [provisioning-service-7:i.c.c.r.s.p.d.DataprocProvisioner@171] - Creating Dataproc cluster cdap-testingdf-5ff986e9-7241-11e9-af46-56bbe5c7844b with system labels {goog-datafusion-version=6_0, cdap-version=6_0_0-1555624816640, goog-datafusion-edition=basic} 2019-05-09 10:01:17,162 - ERROR [provisioning-service-7:i.c.c.i.p.t.ProvisioningTask@151] - PROVISION task failed in REQUESTING_CREATE state for program run program_run:default.testing_df.-SNAPSHOT.workflow.DataPipelineWorkflow.5ff986e9-7241-11e9-af46-56bbe5c7844b. com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden { "code" : 403, "errors" : [ { "domain" : "global", "message" : "Required 'compute.firewalls.list' permission for 'projects/mylab-gcp'", "reason" : "forbidden" } ], "message" : "Required 'compute.firewalls.list' permission for 'projects/mylab-gcp'" } at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146) ~[na:na] at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:113) ~[na:na] at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:40) ~[na:na] at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:321) ~[na:na] at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1065) ~[na:na] at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:419) ~[na:na] at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:352) ~[na:na] at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:469) ~[na:na] at io.cdap.cdap.runtime.spi.provisioner.dataproc.DataprocClient.getFirewallTargetTags(DataprocClient.java:310) ~[na:na] at io.cdap.cdap.runtime.spi.provisioner.dataproc.DataprocClient.createCluster(DataprocClient.java:155) ~[na:na] at io.cdap.cdap.runtime.spi.provisioner.dataproc.DataprocProvisioner.createCluster(DataprocProvisioner.java:172) ~[na:na] at io.cdap.cdap.internal.provision.task.ClusterCreateSubtask.execute(ClusterCreateSubtask.java:43) ~[na:na] at io.cdap.cdap.internal.provision.task.ProvisioningSubtask.execute(ProvisioningSubtask.java:54) ~[na:na] at io.cdap.cdap.internal.provision.task.ProvisioningTask.lambda$executeOnce$0(ProvisioningTask.java:123) ~[na:na] at io.cdap.cdap.common.service.Retries.callWithRetries(Retries.java:183) ~[na:na] at io.cdap.cdap.common.service.Retries.callWithInterruptibleRetries(Retries.java:257) ~[na:na] at io.cdap.cdap.internal.provision.task.ProvisioningTask.executeOnce(ProvisioningTask.java:123) ~[na:na] at io.cdap.cdap.internal.provision.ProvisioningService.lambda$null$16(ProvisioningService.java:559) [na:na] at io.cdap.cdap.internal.provision.ProvisioningService.callWithProgramLogging(ProvisioningService.java:772) [na:na] at io.cdap.cdap.internal.provision.ProvisioningService.lambda$null$17(ProvisioningService.java:557) [na:na] at io.cdap.cdap.common.async.KeyedExecutor$2.run(KeyedExecutor.java:98) ~[na:na] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[na:1.8.0_212] at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[na:1.8.0_212] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) ~[na:1.8.0_212] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) ~[na:1.8.0_212] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_212] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_212] at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_212] 2019-05-09 10:01:17,180 - DEBUG [provisioning-service-7:i.c.c.i.p.t.ProvisioningTask@159] - Terminated PROVISION task for program run program_run:default.testing_df.-SNAPSHOT.workflow.DataPipelineWorkflow.5ff986e9-7241-11e9-af46-56bbe5c7844b due to exception.

我可以在 IAM 控制台中看到我的根 GCP 控制台用户以及服务账户“mylab-bigquery@mylab-gcp.iam.gserviceaccount.com”。我已将根帐户和服务帐户指定为所有者，并在这两个帐户中指定以下附加角色。

BigQuery 管理员计算实例管理 (v1)计算网络管理员计算操作系统管理员登录计算安全管理员云数据融合管理员云数据融合API服务代理所有者

但是，在完成所有这些操作之后，我仍然收到相同的错误消息“'projects/mylab-gcp'需要'compute.firewalls.list'权限”

Answer 1

请看一下创建实例的设置权限步骤:https://cloud.google.com/data-fusion/docs/how-to/create-instance#setting_up_permissions

这应该可以解决您的问题。请注意，这涉及向您的 IAM 策略添加新的服务账户。