<p>I am having difficulties sending requests to my spring boot application deployed in my Google Cloud Kubernetes cluster. My application receives a photo and sends it to the Google Vision API. I am using the provided client library (<a href="https://cloud.google.com/vision/docs/libraries#client-libraries-install-java" rel="nofollow noreferrer">https://cloud.google.com/vision/docs/libraries#client-libraries-install-java</a>) as explained here <a href="https://cloud.google.com/vision/docs/auth" rel="nofollow noreferrer">https://cloud.google.com/vision/docs/auth</a>:</p>

<blockquote>
  <p>If you're using a client library to call the Vision API, use Application Default Credentials (ADC). Services using ADC look for credentials within a GOOGLE_APPLICATION_CREDENTIALS environment variable. Unless you specifically wish to have ADC use other credentials (for example, user credentials), we recommend you set this environment variable to point to your service account key file.</p>
</blockquote>

<p>On my local machine everyting works fine, I have a docker container with an env. varialbe GOOGLE_APPLICATION_CREDENTIALS pointing to my service account key file. </p>

<p>I do not have this variable in my cluster. This is the response I am getting from my application in the Kubernetes cluster:</p>

<pre><code>{
    "timestamp": "2018-05-10T14:07:27.652+0000",
    "status": 500,
    "error": "Internal Server Error",
    "message": "io.grpc.StatusRuntimeException: PERMISSION_DENIED: Request had insufficient authentication scopes.",
    "path": "/image"
}
</code></pre>

<p>What I am doing wrong? Thx in advance!</p>

<p>I also had to specify the GOOGLE_APPLICATION_CREDENTIALS environment variable on my GKE setup, these are the steps I completed thanks to <a href="https://stackoverflow.com/questions/47021469/how-to-set-google-application-credentials-on-gke-running-through-kubernetes">How to set GOOGLE_APPLICATION_CREDENTIALS on GKE running through Kubernetes</a>:</p>

<p><strong>1. Create the secret (in my case in my deploy step on Gitlab):</strong></p>

<pre><code>kubectl create secret generic google-application-credentials --from-file=./application-credentials.json
</code></pre>

<p><strong>2. Setup the volume:</strong></p>

<pre><code>...
volumes:
- name: google-application-credentials-volume
  secret:
    secretName: google-application-credentials
    items:
    - key: application-credentials.json # default name created by the create secret from-file command
      path: application-credentials.json
</code></pre>

<p><strong>3. Setup the volume mount:</strong></p>

<pre><code>spec:
  containers:
  - name: my-service
    volumeMounts:
    - name: google-application-credentials-volume
      mountPath: /etc/gcp
      readOnly: true
</code></pre>

<p><strong>4. Setup the environment variable:</strong></p>

<pre><code>spec:
  containers:
  - name: my-service
    env:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcp/application-credentials.json
</code></pre>
