Personally I've hit this before, and I was never been able to figure out the full set of permissions I need to give to the service account used for GKE.
This page may help?
https://cloud.google.com/kubernetes-engine/docs/how-to/iam. In particular, it seems to suggest that
Kubernetes Engine Developer
is likely insufficient.