Dataflow 服务帐户无法访问网络默认值 [英] Network default is not accessible to Dataflow Service account

问题描述

在没有本地 VPC 网络的项目中启动 Dataflow 作业 (2018-07-16_04_25_02-6605099454046602382) 时遇到此错误

Having issues starting a Dataflow job(2018-07-16_04_25_02-6605099454046602382) in a project without a local VPC Network when I get this error

Workflow failed. Causes: Network default is not accessible to Dataflow
Service account

有一个共享的 VPC 连接到项目，其网络名为 default，在 us-central1 中有一个子网 default - 但是服务用于运行数据流作业的帐户无法访问它.我给了dataflow-service-producer服务账号Compute Network User，没有任何明显的效果.关于我如何处理的任何想法?

There is a shared VPC connected to the project with a networked called default with a subnet default in us-central1 – however the service account used to run dataflow job don't seam to have access to it. I have given the dataflow-service-producer service account Compute Network User, without any noticeable effect. Any ideas on how I can processed?

推荐答案

Cloud Dataflow 中使用子网需要在运行流水线时指定子网参数；但是，如果子网位于共享 VPC 网络中，则需要使用基于以下格式的完整 URL，正如您所提到的.

The usage of subnetworks in Cloud Dataflow requires to specify the subnetwork parameter when running the pipeline; However, in the case of subnetwork that are located in a Shared VPC network, it is required to use the complete URL based on the following format, as you well mentioned.

https://www.googleapis.com/compute/v1/projects/<HOST_PROJECT>/regions/<REGION>/subnetworks/<SUBNETWORK>

此外，在这种情况下，建议验证您是否将项目的 Dataflow 服务帐户添加到共享 VPC 的项目 IAM 表中，并为其授予计算网络用户"角色权限，以确保服务具有所需的访问范围.

Additionally, in this cases is recommended to verify that you are adding the project's Dataflow service account into the Shared VPC's project IAM table and give it the "Compute Network User" role permission in order to ensure that the service has the required access scope.

最后，似乎子网参数官方Google 的文档已经提供了有关此问题的详细信息.

Finally, it is seems that the Subnetwork parameter official Google's documentation is alraedy available with detailed information about this matter.

这篇关于Dataflow 服务帐户无法访问网络默认值的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！