[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Understanding Feature State Conditions\n======================================\n\n\n**Note:** Canonical Services are supported automatically in Cloud Service Mesh version 1.6.8 and higher.\n\nThis page describes how to interpret and act upon Conditions reported on your Cloud Service Mesh cluster or fleet.\n\nTo check for conditions, run this command: \n\n gcloud container fleet mesh describe --project \u003cvar translate=\"no\"\u003eFLEET_PROJECT\u003c/var\u003e\n\nThe output may include `conditions` in `membershipStates` for a cluster, like: \n\n ...\n membershipStates:\n projects/test-project/locations/us-central1/memberships/my-membership:\n servicemesh:\n conditions:\n - code: \u003cCONDITION_CODE\u003e\n details: ...\n documentationLink: ....\n severity: ...\n\nValues of `code` are described in more detail on this page.\n\nNODEPOOL_WORKLOAD_IDENTITY_FEDERATION_REQUIRED\n----------------------------------------------\n\nYou may see the `NODEPOOL_WORKLOAD_IDENTITY_FEDERATION_REQUIRED` error code in\nthe `Conditions` field of your membership: \n\n membershipStates:\n projects/test-project/locations/us-central1/memberships/my-membership:\n servicemesh:\n conditions:\n - code: NODEPOOL_WORKLOAD_IDENTITY_FEDERATION_REQUIRED\n details: One or more node pools have workload identity federation disabled.\n documentationLink: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity\n severity: ERROR\n controlPlaneManagement:\n details:\n - code: REVISION_FAILED_PRECONDITION\n details: Required in-cluster components are not ready. This will be retried\n within 15 minutes.\n implementation: TRAFFIC_DIRECTOR\n state: FAILED_PRECONDITION\n\nThis error is shown if the GKE cluster does not have [Workload Identity Federation](/kubernetes-engine/docs/how-to/workload-identity)\nenabled on all node pools of that cluster, since this is a prerequisites for the\ninstallation of Cloud Service Mesh.\n\nTo resolve this error message, you must follow instructions to\n[Enable Workload Identity Federation](/kubernetes-engine/docs/how-to/workload-identity#enable_on_clusters_and_node_pools)\non all node pools. Note that enablement may vary depending on your specific\ncluster case.\n\nAfter enablement, the error message should be automatically removed and your\ncluster should go back to `ACTIVE` state. If the issue persists and you need\nadditional assistance, see [Getting support](/service-mesh/v1.23/docs/getting-support).\n\nMESH_IAM_PERMISSION_DENIED\n--------------------------\n\nThis error indicates that the service account does not have enough permission to access your fleet project. Follow the steps for troubleshooting:\n\n1. Verify if your service account has granted `Anthos Service Mesh Service Agent` role. For details on how to verify IAM permission and add it, go to [Revision(s) reporting as unhealthy error](/service-mesh/v1.23/docs/managed/troubleshoot-managed-anthos-service-mesh#revisions_reporting_as_unhealthy_error) and use the same steps there.\n\n2. If permission is verified while issue persists, contact Google customer support for further assistance.\n\nMESH_IAM_CROSS_PROJECT_PERMISSION_DENIED\n----------------------------------------\n\nThis error indicates that the fleet project service account does not have enough permission to access a different project (the cluster project or the network project).\n\nFor [Shared VPC](/vpc/docs/shared-vpc#shared_vpc_networks), make sure to grant all the fleet projects service account `Anthos Service Mesh Service Agent` role in the Shared VPC network project.\n\nFor the GKE fleet project and cluster project scenarios, make sure to grant the fleet project service account `Anthos Service Mesh Service Agent` role in the cluster project.\n\nExample troubleshooting command:\n\n1. Verify if your network project or cluster project service account has granted `Anthos Service Mesh Service Agent` role to the fleet project service account. If not, run:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eNETWORK_OR_CLUSTER_PROJECT_ID\u003c/var\u003e \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eFLEET_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-servicemesh.iam.gserviceaccount.com\" \\\n --role roles/anthosservicemesh.serviceAgent\n\n In addition, confirm that you don't have automation that would remove this binding.\n2. If permission is verified while issue persists, contact Google customer support for further assistance."]]
