クラスタに実行中のノードプールがない場合、または Connect ゲートウェイがノードプールに接続できない場合、error: the server doesn't have a resource type "services" などのエラーが発生することがあります。ノードプールのステータスを確認するには、次のコマンドを実行します。
Error from server (Forbidden): users "administrator@example.com" is forbidden:
User "system:serviceaccount:gke-connect:connect-agent-sa" cannot impersonate
resource "users" in API group "" at the cluster scope
Connect ゲートウェイを使用しているときに、kubectl exec、kubectl attach、kubectl port-forward コマンドがメッセージ「error: unable to upgrade connection」で失敗することがあります。これは、Connect ゲートウェイを Kubernetes API Server エンドポイントとして使用する場合の制限事項です。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-07-15 UTC。"],[],[],null,["# Troubleshoot common issues\n==========================\n\nThis page shows you how to resolve common issues with GKE on Azure.\nIf you need additional assistance, reach out to [Cloud Customer Care](/kubernetes-engine/multi-cloud/docs/azure/getting-support).\n\nCommon error messages\n---------------------\n\nThe following sections explain the causes and resolutions for some common\nerror messages.\n\n### Server doesn't have a resource\n\nErrors such as `error: the server doesn't have a resource type \"services\"` can\nhappen when a cluster has no running node pools, or Connect gateway cannot\nconnect to a node pool. To check the status of your node pools, run the\nfollowing command: \n\n gcloud container azure node-pools list \\\n --cluster-name \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the Google Cloud location that manages your cluster\n\nThe output includes the status of your cluster's node pools. If you don't have\na node pool listed, [Create a node pool](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-node-pool).\n\n### Forbidden user\n\nThe following error occurs when your username does not have administrator access\nto your cluster: \n\n Error from server (Forbidden): users \"administrator@example.com\" is forbidden:\n User \"system:serviceaccount:gke-connect:connect-agent-sa\" cannot impersonate\n resource \"users\" in API group \"\" at the cluster scope\n\nYou can configure additional users by passing the\n[`--admin-users`](/sdk/gcloud/reference/container/azure/clusters/create#--admin-users)\nflag when you create a cluster.\n\nIf you use Connect gateway and can't connect to your cluster, try the following\nsteps:\n\n1. Get the authorized users for your cluster.\n\n gcloud container azure clusters describe \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --format 'value(authorization.admin_users)'\n\n Replace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with your cluster's name.\n\n The output includes the usernames with administrator access to the cluster.\n For example: \n\n {'username': 'administrator@example.com'}\n\n2. Get the username currently authenticated with the Google Cloud CLI.\n\n gcloud config get-value account\n\n The output includes the account authenticated with the Google Cloud CLI. If\n the output of the `gcloud containers azure clusters describe` and `gcloud\n config get-value account` don't match, run `gcloud auth login` and\n authenticate as the username with administrative access to the cluster.\n\nIssues with kubectl commands\n----------------------------\n\nThe following sections provide guidance on how to resolve issues with\nunresponsive or failing `kubectl` commands.\n\n### kubectl commands stop responding\n\nIf your cluster runs a Kubernetes version earlier than 1.25 and `kubectl`\ncommands are unresponsive or time out, the most common reason is that you have\nnot yet created a node pool. By default, GKE on Azure generates\n`kubeconfig` files that use Connect gateway as an internet-reachable endpoint.\nFor this to work, the `gke-connect-agent` Deployment needs to be running in\na node pool on the cluster.\n\nFor more diagnostic information, run the following command: \n\n kubectl cluster-info -v=9\n\nIf there are no running node pools, you see requests to\n`connectgateway.googleapis.com` fail with a 404\n`cannot find active connections for cluster` error.\n\nFor clusters with a Kubernetes version of 1.25 or later, the `gke-connect-agent`\nruns on the control plane, and a node pool is not required. If the `kubectl` command\nis unresponsive, check the control plane component logs with\n[Cloud Logging](/kubernetes-engine/multi-cloud/docs/azure/how-to/cloud-logging#control_plane_logs).\n\n### kubectl exec, attach, and port-forward commands fail\n\nThe `kubectl exec`, `kubectl attach`, and `kubectl port-forward` commands might\nfail with the message `error: unable to upgrade connection` when using\nConnect gateway. This is a limitation when using Connect gateway as your\nKubernetes API Server endpoint.\n\nTo work around this, use a `kubeconfig` that specifies the cluster's\nprivate endpoint. For instructions on accessing the cluster through its\nprivate endpoint, see\n[Configure cluster access for kubectl](/kubernetes-engine/multi-cloud/docs/azure/how-to/configure-cluster-access-for-kubectl).\n\n### Generic kubectl troubleshooting\n\nIf you use Connect gateway:\n\n- Ensure you have enabled Connect gateway in your Google Cloud project:\n\n gcloud services enable connectgateway.googleapis.com\n\n- For clusters with a Kubernetes version earlier than 1.25, ensure that you have at\n least one Linux node pool running and that the `gke-connect-agent` is running.\n For details, see\n [Troubleshoot cluster connections](/anthos/fleet-management/docs/troubleshooting).\n\n- For clusters with a Kubernetes version of 1.25 or later, check the `gke-connect-agent`\n logs with [Cloud Logging](/kubernetes-engine/multi-cloud/docs/azure/how-to/cloud-logging#control_plane_logs).\n\nWhat's next\n-----------\n\n- If you need additional assistance, reach out to [Cloud Customer Care](/kubernetes-engine/multi-cloud/docs/azure/getting-support)."]]
