GKE private cluster unable to add Control plane authorised networks "The cluster update failed."

[amitthk]

Hi,

I had an issue with GKE was unable to create the cluster with public IP (constraints/compute.vmExternalIpAccess violated). No matter how I tried, the cluster didn't come up. So I created the private cluster. Now in this cluster the deployments are failing. To make it work I had to create a secret for the docker registry. To create secret I had to connect to its endpoint which is not happening.

I already Enabled "Control plane authorised networks". But when I try to add my IP address to it - it just doesn't save. it gives error "Control plane authorised networks"

Is there any other way to reach this private GKE cluster to be able to deploy using Kubernetes.  The public GKE cluster is crashing due to  and private is useless. I wonder how to deploy the workloads to GKE now.

[garisingh]

You mention a few issues above, but I'm not exactly sure if/how they are related.   

So you have a private cluster now but you cannot access the Kubernetes API server endpoint to deploy your workloads?   Which docker registry are you using?  Dockerhub?

[amitthk]

I am using the asia.gcr.io. I pushed the images to this registry and followed the documentation. Cannot use public dockerhub images its a private project.

[amitthk · Accepted solution]

What I eventually did is to create a new principal and assign it the role which had "Artifactory Reader" permission:

gcloud artifacts repositories add-iam-policy-binding my-docker-repository \
  --location=asia-southeast1 \
  --member=serviceAccount:<project-number-in-digits>-compute@developer.gserviceaccount.com \
  --role="roles/artifactregistry.reader"