<p>I have set up a private cluster on GKE with k8s version <code>1.18.12-gke.1206</code> and Access to cluster endpoint is set to <strong>Public endpoint access enabled, authorized networks disabled.</strong> I'm running an ingress controller on this cluster of type <a href="https://kubernetes.github.io/ingress-nginx" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx</a>. Which uses a configMap to store configuration. But somehow any request coming to this controller, is giving an Unauthorized error with logs as:</p>
<pre><code>2021-02-23 11:24:59.435 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.Endpoints: Unauthorized&quot;
2021-02-23 11:24:45.072 IST     &quot;error retrieving resource lock sb-system/ingress-controller-leader-nginx: Unauthorized&quot;
2021-02-23 11:24:40.727 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.ConfigMap: Unauthorized&quot;
2021-02-23 11:24:40.132 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1beta1.Ingress: Unauthorized&quot;
2021-02-23 11:24:37.318 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.Pod: Unauthorized&quot;
2021-02-23 11:24:37.038 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.Service: Unauthorized&quot;
2021-02-23 11:24:29.891 IST     &quot;error retrieving resource lock sb-system/ingress-controller-leader-nginx: Unauthorized&quot;
2021-02-23 11:24:26.263 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.Secret: Unauthorized&quot;
2021-02-23 11:24:18.259 IST     &quot;error retrieving resource lock sb-system/ingress-controller-leader-nginx: Unauthorized&quot;
2021-02-23 11:24:09.907 IST     &quot;error retrieving resource lock sb-system/ingress-controller-leader-nginx: Unauthorized&quot;
2021-02-23 11:24:06.612 IST     &quot;pkg/mod/k8s.io/client-go@v0.18.5/tools/cache/reflector.go:125: Failed to list *v1.Endpoints: Unauthorized&quot;
2021-02-23 11:24:02.078 IST     &quot;error retrieving resource lock sb-system/ingress-controller-leader-nginx: Unauthorized&quot;
</code></pre>
<p>we tried to follow the steps mentioned <a href="https://kubernetes.github.io/ingress-nginx/troubleshooting/" rel="nofollow noreferrer">here</a>. and we are getting</p>
<pre><code>  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   233  100   233    0     0  17282      0 {-:--:-- --:--:-- --:--:--     0
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {

  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;forbidden: User \&quot;system:anonymous\&quot; cannot get path \&quot;/\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {

  },
  &quot;code&quot;: 403
}--:--:-- --:--:-- --:--:-- 17923
</code></pre>
<p>at the last Step which is: <code>kubectl exec test -- curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H  &quot;Authorization: Bearer $TOKEN_VALUE&quot; https://10.0.0.1</code></p>
<p>I'm new to GCP and K8s, can't figure out what wrong I'm doing.</p>

<p>Did you check whether automountServiceAccountToken had been set to false on your ServiceAccount? If so, set it to true might help.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
automountServiceAccountToken: false # set to true
</code></pre>
<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server</a></p>
