Halaman ini menunjukkan cara menyelesaikan masalah yang mungkin Anda alami saat menggunakan
Eventarc untuk GKE, termasuk endpoint publik
layanan pribadi dan publik yang berjalan di cluster
GKE.
Untuk masalah lain yang mungkin juga Anda alami, lihat pemecahan masalah untuk:
Pembuatan pemicu gagal karena error izin pembuatan resource
Anda menerima pesan error yang mirip dengan salah satu pesan berikut:
Error applying IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':
Error setting IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':
googleapi: Error 403: Permission iam.serviceAccounts.setIamPolicy is required to perform this
operation on service account SERVICE_ACCOUNT., forbidden
Error when reading or editing Container Cluster "cluster": googleapi:
Error 403: Required "container.clusters.get" permission(s) for "..."., forbidden
Error reading instance group manager returned as an instance group URL:
"googleapi: Error 403: Required 'compute.instanceGroupManagers.get' permission
for '...', forbidden"
Error ini terjadi saat Anda belum menyiapkan akun layanan Eventarc dengan benar yang diperlukan oleh Eventarc untuk mengelola resource di cluster Google Kubernetes Engine (GKE).
Untuk mengatasi masalah ini, pastikan akun layanan Eventarc telah dikonfigurasi dengan benar dengan izin yang sesuai untuk membuat resource.
Untuk mengetahui informasi selengkapnya, ikuti petunjuk untuk
penyedia, jenis peristiwa, dan tujuan GKE tertentu.
Pembuatan pemicu gagal karena cluster target tidak dapat ditemukan atau tidak mengaktifkan Workload Identity Federation untuk GKE
Anda menerima pesan error yang mirip dengan salah satu pesan berikut:
ERROR: (gcloud.eventarc.triggers.create) NOT_FOUND: Not found: projects/PROJECT_ID/locations/
LOCATION/clusters/CLUSTER_NAME.
...
ERROR: (gcloud.eventarc.triggers.create) INVALID_ARGUMENT: workload identity is not enabled on
cluster CLUSTER_NAME in LOCATION
...
Error ini terjadi saat Eventarc tidak dapat menemukan cluster GKE target atau cluster tidak mengaktifkan Workload Identity Federation untuk GKE.
Pembuatan pemicu gagal karena status resource tidak valid
Anda menerima pesan error yang mirip dengan berikut ini untuk project Anda:
ERROR: (gcloud.eventarc.triggers.create) Invalid resource state for projects/PROJECT_ID/locations/LOCATION/triggers/TRIGGER_ID.
Ensure that you have enabled your GKE destination and assigned required permissions to the service account.
For more information, see https://cloud.google.com/eventarc/standard/docs/gke/troubleshooting.
Error ini terjadi saat:
Tujuan GKE Anda belum diaktifkan.
Akun layanan belum diberi peran dan izin yang diperlukan
yang memungkinkan Eventarc mengelola peristiwa untuk tujuan GKE.
Pastikan akun layanan Eventarc telah
dikonfigurasi dengan izin yang sesuai untuk membuat resource. Untuk mengetahui informasi selengkapnya tentang cara
memberikan peran yang sesuai ke akun layanan, ikuti
petunjuk untuk penyedia dan jenis peristiwa tertentu
di bagian "Bersiap membuat pemicu".
TRIGGER: ID pemicu atau ID yang memenuhi syarat sepenuhnya.
LOCATION: lokasi pemicu Eventarc.
Jika pemicu masih tidak berfungsi, periksa status komponen penerusan peristiwa Eventarc untuk melihat apakah komponen tersebut telah di-deploy dengan benar:
Identifikasi namespace cluster dengan mencantumkan semua pod yang memiliki
event-forwarder dalam namanya:
30 karakter pertama namespace harus cocok dengan nama pemicu Eventarc yang Anda buat, diikuti dengan hash untuk membedakan pemicu dengan 30 karakter awal yang sama.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eThis document provides troubleshooting steps for issues encountered when using Eventarc for GKE, covering common errors and their solutions.\u003c/p\u003e\n"],["\u003cp\u003eTrigger creation failures often stem from incorrect Eventarc service account permissions, missing GKE clusters, or Workload Identity Federation not being enabled on the target cluster.\u003c/p\u003e\n"],["\u003cp\u003eIf a trigger is created successfully but events aren't delivered, check for Pub/Sub message drops by implementing a retry policy or dead-letter queue and examine the event forwarder's status.\u003c/p\u003e\n"],["\u003cp\u003eEnsure that GKE destinations are enabled and that the Eventarc service account has been granted the necessary roles and permissions to manage events.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA products are available "as is" and might have limited support.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot Eventarc for Google Kubernetes Engine (GKE)\n\n[Standard](/eventarc/standard/docs/overview)\n|\n| **Preview**\n|\n|\n| This product is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page shows you how to resolve issues that you might encounter when using\nEventarc for GKE, including the public\nendpoints of private and public services running in a GKE\ncluster.\n\nFor other issues that you might also encounter, refer to troubleshooting for:\n\n- [Issues common to all destinations](/eventarc/docs/troubleshooting)\n- [Eventarc for Cloud Run](/eventarc/standard/docs/run/troubleshoot)\n- [Eventarc for Workflows](/eventarc/standard/docs/workflows/troubleshoot)\n\nTrigger creation fails with resource creation permission errors\n---------------------------------------------------------------\n\nYou receive error messages similar to one of the following: \n\n```\nError applying IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':\nError setting IAM policy for service account 'projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT':\ngoogleapi: Error 403: Permission iam.serviceAccounts.setIamPolicy is required to perform this\noperation on service account SERVICE_ACCOUNT., forbidden\n```\n\n\u003cbr /\u003e\n\n```\nError when reading or editing Container Cluster \"cluster\": googleapi:\nError 403: Required \"container.clusters.get\" permission(s) for \"...\"., forbidden\n``` \n\n```\nError reading instance group manager returned as an instance group URL:\n\"googleapi: Error 403: Required 'compute.instanceGroupManagers.get' permission\nfor '...', forbidden\"\n```\n\nThis error occurs when you have not correctly set up the Eventarc\nservice account that is required by Eventarc to manage\nresources in the Google Kubernetes Engine (GKE) cluster.\n\nTo resolve the issue, ensure that the Eventarc service account\nhas been configured correctly with the appropriate permissions to create resources.\nFor more information, follow the instructions for a\n[specific provider, event type, and GKE destination](/eventarc/standard/docs/event-providers-targets#triggers).\n\nTrigger creation fails because target cluster cannot be found or does not have Workload Identity Federation for GKE enabled\n---------------------------------------------------------------------------------------------------------------------------\n\nYou receive error messages similar to one of the following: \n\n```\nERROR: (gcloud.eventarc.triggers.create) NOT_FOUND: Not found: projects/PROJECT_ID/locations/\nLOCATION/clusters/CLUSTER_NAME.\n...\n``` \n\n```\nERROR: (gcloud.eventarc.triggers.create) INVALID_ARGUMENT: workload identity is not enabled on\ncluster CLUSTER_NAME in LOCATION\n...\n```\n\nThis error occurs when Eventarc cannot find the target\nGKE cluster or the cluster does not have Workload Identity Federation for GKE\nenabled.\n\nTo resolve the issue, ensure that the target cluster exists and has\n[Workload Identity enabled](/kubernetes-engine/docs/how-to/workload-identity).\n\nTrigger creation fails because of invalid resource state\n--------------------------------------------------------\n\nYou receive an error message similar to the following for your project: \n\n```\nERROR: (gcloud.eventarc.triggers.create) Invalid resource state for projects/PROJECT_ID/locations/LOCATION/triggers/TRIGGER_ID.\nEnsure that you have enabled your GKE destination and assigned required permissions to the service account.\nFor more information, see https://cloud.google.com/eventarc/standard/docs/gke/troubleshooting.\n```\n\nThis error occurs when:\n\n- Your GKE destination hasn't been enabled.\n- The service account has not been granted the required roles and permissions that enables Eventarc to manage events for GKE destinations.\n\n\u003cbr /\u003e\n\nTo resolve this issue:\n\n1. Ensure that you have enabled GKE destinations: \n\n ```bash\n gcloud eventarc gke-destinations init\n ```\n For more information, follow the instructions for a [specific provider and event type](/eventarc/standard/docs/event-providers-targets#triggers) in the \"Enable GKE destinations\" section.\n2. Ensure that the Eventarc service account has been configured with the appropriate permissions to create resources. For more information on how to grant the appropriate roles to the service account, follow the instructions for a [specific provider and event type](/eventarc/standard/docs/event-providers-targets#triggers) in the \"Prepare to create a trigger\" section.\n3. If the error persists, [contact support](/eventarc/docs/getting-support).\n\nTrigger is created successfully but target is not receiving events\n------------------------------------------------------------------\n\nCheck that enough time has elapsed since creating the trigger. It can take up to\ntwo minutes before events are sent.\n\n1. If events are not being delivered at the target, events sent from\n Pub/Sub to the target might be getting dropped:\n\n To ensure that events aren't dropped, set up a\n [Pub/Sub subscription retry policy](/pubsub/docs/handling-failures#subscription_retry_policy)\n or [forward undelivered messages to a dead-letter topic](/pubsub/docs/handling-failures#forwarding_to)\n (also known as a dead-letter queue).\n\n Before setting the dead-letter topic, retrieve the trigger's topic and subscription: \n\n ```bash\n gcloud eventarc triggers describe TRIGGER \\\n --location=LOCATION\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eTRIGGER\u003c/var\u003e: the ID of the trigger or a fully qualified identifier.\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of the Eventarc trigger.\n2. If the trigger still doesn't work, check the status of Eventarc's\n event forwarder component to see if it has been deployed properly:\n\n 1. Identify the cluster namespaces by listing all pods that have `event-forwarder` in their name: \n\n ```bash\n kubectl get pods --all-namespaces | grep event-forwarder\n ```\n The output is similar to the following: \n\n ```\n event-forwarder-namespace-hash1 event-forwarder-hash1 1/1 Running 0 5d2h\n event-forwarder-namespace-hash2 event-forwarder-hash2 1/1 Running 0 2d2h\n ```\n The first 30 characters of the namespaces should match the name of the Eventarc trigger you created, followed by a hash to disambiguate any triggers with the same initial 30 characters.\n 2. Retrieve the deployment details: \n\n ```bash\n kubectl get deployments -n EVENT_FORWARDER_NAMESPACE event-forwarder\n ```\n 3. Retrieve the pod details: \n\n ```bash\n kubectl describe pod -n EVENT_FORWARDER_NAMESPACE EVENT_FORWARDER_HASH\n ```\n 4. Print the pod logs to investigate why or where the failure has occurred: \n\n ```bash\n kubectl logs -f -n EVENT_FORWARDER_NAMESPACE EVENT_FORWARDER_HASH\n ```\n For example, in the following log, the service account has had the `Pub/Sub Subscriber` role revoked: \n\n ```\n {\"error\":\"generic::permission_denied: missing 'pubsub.subscriptions.consume' permission\",\n \"message\":\"Permissions check failed\",\"severity\":\"fatal\",\"timestamp\":\"2021-07-07T14:57:49.038877483Z\"}\n ```\n\nRelated information\n-------------------\n\n- Learn more about [Eventarc for GKE](/eventarc/standard/docs/overview#gke).\n- To get additional help, see [Get support](/eventarc/docs/getting-support)."]]
