add role for shared VPC

Author: mletalie

modules/osd-create-cluster-ccs.adoc

@@ -270,7 +270,7 @@ To install a cluster into a Shared VPC, you must use {product-title} version 4.1
 +
 [IMPORTANT]
 ====
-Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, and *DNS Administrator*.
+Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, *Project IAM Admin*, and *DNS Administrator*.
 The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails.
 For information about Shared VPC permissions, see link:https://cloud.google.com/vpc/docs/provisioning-shared-vpc#migs-service-accounts[Provision Shared VPC].
 ====

modules/osd-create-cluster-gcp-account.adoc

@@ -113,7 +113,7 @@ To install a cluster into a Shared VPC, you must use {product-title} version 4.1
 +
 [IMPORTANT]
 ====
-Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, and *DNS Administrator*.
+Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, *Project IAM Admin*, and *DNS Administrator*.
 The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails.
 For information about Shared VPC permissions, see link:https://cloud.google.com/vpc/docs/provisioning-shared-vpc#migs-service-accounts[Provision Shared VPC].
 ====

modules/osd-create-cluster-rhm-gcp-account.adoc

@@ -113,7 +113,7 @@ To install a cluster into a Shared VPC, you must use {product-title} version 4.1
 +
 [IMPORTANT]
 ====
-Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, and *DNS Administrator*.
+Once you complete the steps within the cluster configuration wizard and click *Create Cluster*, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: *Compute Network Administrator*, *Compute Security Administrator*, *Project IAM Admin*, and *DNS Administrator*.
 The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails.
 For information about Shared VPC permissions, see link:https://cloud.google.com/vpc/docs/provisioning-shared-vpc#migs-service-accounts[Provision Shared VPC].
 ====