<p>I am working on a Kubernetes CronJob in GKE to <a href="https://cloud.google.com/sql/docs/mysql/import-export/exporting" rel="nofollow noreferrer">export SQL databases from GCP Cloud SQL</a>. I have a single GCP Cloud SQL instance whose Google service account is <code>p848827672298-eef1pd@gcp-sa-cloud-sql.iam.gserviceaccount.com</code>. If I add to this service account the permission to access and create bucket objects, running the <code>gcloud sql export sql ...</code> command <em>works</em>: the database is exported to my bucket.</p>
<p>However, what I want to do is use <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">Workload Identity</a> to bind a Kubernetes service account to the <code>p848827...</code> Google service account so that the CronJob can export the Cloud SQL database to my bucket. I try to do this by running this command:</p>
<pre><code>gcloud iam service-accounts add-iam-policy-binding \
  --role roles/iam.workloadIdentityUser \
  --member &quot;serviceAccount:PROJECT_ID.svc.id.goog[K8_NAMESPACE/K8_SERVICE_ACCOUNT]&quot; \
  p848827672298-eef1pd@gcp-sa-cloud-sql.iam.gserviceaccount.com
</code></pre>
<p>(Of course, I replaced <code>PROJECT_ID</code>, <code>K8_NAMESPACE</code>, and <code>K8_SERVICE_ACCOUNT</code> with the appropriate values for my project.)</p>
<p>This results in</p>
<pre><code>ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Service account projects/PROJECT_ID/serviceAccounts/p848827672298-eef1pd@gcp-sa-cloud-sql.iam.gserviceaccount.com does not exist.        
</code></pre>
<p>How do I bind the Cloud SQL service account to my Kubernetes service account?</p>

<p>Hope your API enabled, please trying disabling and enabling API once faced once similar issue and worked: <code>gcloud services  enable compute.googleapis.com</code>
<a href="https://dzone.com/articles/enabling-gke-workload-identity" rel="nofollow noreferrer">https://dzone.com/articles/enabling-gke-workload-identity</a></p>
<p>If you have a serviceaccount JSON file you can directly inject it to POD also as volume mount secret also.</p>
<pre><code>kubectl create secret generic echo --from-file service-account.json
</code></pre>
<p>Now suppose you are deploying the application with the secret injection</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo
  labels:
    app: echo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: echo
  template:
    metadata:
      labels:
        app: echo
      name: echo
    spec:
      containers:
        - name: echo
          image: &quot;gcr.io/hightowerlabs/echo&quot;
          env:
            - name: &quot;GOOGLE_APPLICATION_CREDENTIALS&quot;
              value: &quot;/var/run/secret/cloud.google.com/service-account.json&quot;
            - name: &quot;PROJECT_ID&quot;
              valueFrom:
                configMapKeyRef:
                  name: echo
                  key: project-id
            - name: &quot;TOPIC&quot;
              value: &quot;echo&quot;
          volumeMounts:
            - name: &quot;service-account&quot;
              mountPath: &quot;/var/run/secret/cloud.google.com&quot;
            - name: &quot;certs&quot;
              mountPath: &quot;/etc/ssl/certs&quot;
      volumes:
        - name: &quot;service-account&quot;
          secret:
            secretName: &quot;echo&quot;
        - name: &quot;certs&quot;
          hostPath:
            path: &quot;/etc/ssl/certs&quot;
</code></pre>
<p>Example : <a href="https://github.com/kelseyhightower/gke-service-accounts-tutorial#google-cloud-service-accounts-with-google-container-engine-gke---tutorial" rel="nofollow noreferrer">https://github.com/kelseyhightower/gke-service-accounts-tutorial#google-cloud-service-accounts-with-google-container-engine-gke---tutorial</a></p>
