我正在尝试在GKE project-1中创建一个与project-2共享网络的集群。
分配给服务帐户的角色：
project-1：Kubernetes Engine Cluster Admin，Compute Network Admin，Kubernetes Engine Host Service Agent User
project-2：Kubernetes Engine Service Agent，Compute Network User，Kubernetes Engine Host Service Agent User
服务帐户在项目-1下创建。在两个项目中均启用了API和服务。
但是我总是得到这个错误。错误：403：您访问的页面不存在Kubernetes Engine Service Agent缺少此项目所需的权限。请参阅故障排除|Kubernetes发动机文档|Google Cloud了解更多信息：“projects/project-2”需要“container.hostServiceAgent.use”权限。禁止

data "google_compute_network" "shared_vpc" {
    name = "network-name-in-project-2"
    project = "project-2"
}

 
data "google_compute_subnetwork" "shared_subnet" {
    name = "subnet-name-in-project-2"
    project = "project-2"
    region = "us-east1"
}

 # cluster creation under project 1
 # project 1 specified in Provider 
resource "google_container_cluster" "mowx_cluster" {
    name = var.cluster_name
    location = "us-east1"
    initial_node_count = 1
 
    master_auth {
        username = ""
        password = ""
 
        client_certificate_config {
            issue_client_certificate = false
        }
    }
 
    remove_default_node_pool = true
    cluster_autoscaling {
        enabled = false
    }
 
    # cluster_ipv4_cidr = var.cluster_pod_cidr
    ip_allocation_policy {
        cluster_secondary_range_name = "pods"
        services_secondary_range_name = "svc"
    }
 
    network = data.google_compute_network.shared_vpc.id
    subnetwork = data.google_compute_subnetwork.shared_subnet.id
}