Missing IAM roles in prerequisites documentation
The README currently lists two required IAM roles for the galaxy-batch-runner service account:
roles/batch.jobsEditorroles/iam.serviceAccountUser
Two additional roles are required but not documented:
roles/batch.agentReporter
The Batch VM agent authenticates as the galaxy-batch-runner SA to report task status back to batch.googleapis.com. Without this role, the agent starts (agent,start state) but cannot phone home, causing the 1080-second timeout with error: "no VM has agent reporting correctly within the time window".
roles/logging.logWriter
Batch VMs write job logs to Cloud Logging using this SA. Without this role, jobs run successfully but no logs appear in the GCP Batch console.
Missing IAM roles in prerequisites documentation
The README currently lists two required IAM roles for the
galaxy-batch-runnerservice account:roles/batch.jobsEditorroles/iam.serviceAccountUserTwo additional roles are required but not documented:
roles/batch.agentReporterThe Batch VM agent authenticates as the
galaxy-batch-runnerSA to report task status back tobatch.googleapis.com. Without this role, the agent starts (agent,startstate) but cannot phone home, causing the 1080-second timeout with error: "no VM has agent reporting correctly within the time window".roles/logging.logWriterBatch VMs write job logs to Cloud Logging using this SA. Without this role, jobs run successfully but no logs appear in the GCP Batch console.