几天后，我尝试在 GCP 上部署 Kubeflow 1.3，但未向 Config Connector 服务帐户授予所有者角色。作为参考，我正在关注官方文档。到目前为止，我能够部署管理集群（使用 Config Connector 服务帐户运行），但是在实际部署 Kubeflow 集群时，它卡在了最初的步骤之一：创建一个几乎没有效果的 CloudSQL 实例感觉服务帐户实际上有权这样做。这是我授予服务帐户的角色的完整列表：
roles/accessapproval.approver
roles/accessapproval.configEditor
roles/accesscontextmanager.policyAdmin
roles/aiplatform.admin
roles/aiplatform.customCodeServiceAgent
roles/aiplatform.serviceAgent
roles/anthos.serviceAgent
roles/anthosaudit.serviceAgent
roles/anthosconfigmanagement.serviceAgent
roles/anthosidentityservice.serviceAgent
roles/anthosservicemesh.serviceAgent
roles/apigateway.admin
roles/apigee.apiAdmin
roles/artifactregistry.admin
roles/artifactregistry.serviceAgent
roles/automl.admin
roles/automl.serviceAgent
roles/bigquery.admin
roles/bigqueryconnection.serviceAgent
roles/bigquerydatatransfer.serviceAgent
roles/binaryauthorization.serviceAgent
roles/cloudasset.owner
roles/cloudasset.serviceAgent
roles/cloudbuild.builds.builder
roles/cloudbuild.builds.editor
roles/cloudbuild.serviceAgent
roles/clouddeploy.serviceAgent
roles/cloudfunctions.developer
roles/cloudfunctions.serviceAgent
roles/cloudscheduler.serviceAgent
roles/cloudsql.admin
roles/cloudsql.serviceAgent
roles/cloudtasks.serviceAgent
roles/cloudtpu.serviceAgent
roles/composer.admin
roles/composer.serviceAgent
roles/compute.admin
roles/compute.serviceAgent
roles/container.admin
roles/container.serviceAgent
roles/containeranalysis.admin
roles/containerregistry.ServiceAgent
roles/dataflow.admin
roles/deploymentmanager.editor
roles/endpoints.portalAdmin
roles/endpoints.serviceAgent
roles/gkehub.admin
roles/gkehub.gatewayAdmin
roles/gkehub.serviceAgent
roles/gkemulticloud.serviceAgent
roles/iam.securityAdmin
roles/iam.serviceAccountAdmin
roles/iam.workloadIdentityPoolAdmin
roles/iap.admin
roles/managedidentities.admin
roles/managedidentities.serviceAgent
roles/meshconfig.admin
roles/meshconfig.serviceAgent
roles/meshdataplane.serviceAgent
roles/ml.admin
roles/ml.serviceAgent
roles/monitoring.admin
roles/multiclusteringress.serviceAgent
roles/networkmanagement.serviceAgent
roles/notebooks.admin
roles/notebooks.serviceAgent
roles/oauthconfig.viewer
roles/privateca.admin
roles/resourcemanager.projectIamAdmin
roles/run.admin
roles/run.serviceAgent
roles/secretmanager.admin
roles/serverless.serviceAgent
roles/servicebroker.admin
roles/serviceusage.serviceUsageAdmin
roles/sourcerepo.serviceAgent
roles/storage.admin
roles/tpu.admin
roles/tpu.serviceAgent
roles/vpcaccess.admin
roles/workflows.admin
你有什么建议我可能需要将哪些额外的角色赋予服务帐户，这样这件事才能真正起作用？我不知道这是否重要，但我通过 gcloud cli 授予角色（在此阶段根本不使用iam.yaml）。
PS：我知道这个想法是有两个独立的项目（一个用于管理集群，另一个用于 kubeflow 集群），并且您只需要授予kubeflow 项目的所有者权限，但这并不是企业真正想要的。