<p>I've configured my cluster and node pools for Workload Identity (<a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a>) but in order to get it to work, I need to also make my pods use the kubernetes service account I created for the Workload Identity.</p>
<p>I see I can specify the <code>serviceAccountName</code> in a pod's YAML, but how can I do this using Google CI/CD which uses deployment.yaml?  Or can I somehow reference a pod's YAML for use as a spec template within my deployment.yaml?  Sorry, I am new to k8s!</p>
<p>Ref. <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/</a></p>
<p>Essentially, I am just trying to get Workload Identity to work with my application so the <code>GOOGLE_APPLICATION_CREDENTIALS</code> is set by Google for use within my app!</p>
<p>I've tried the following in my deployment.yaml but I get the error <code>unknown field &quot;serviceAccountName&quot; in io.k8s.api.core.v1.Container;</code>:</p>
<pre><code>spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-application
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: my-application
    spec:
      containers:
        - image: &gt;-
            gcr.io/my-project/github.com/my-org/my-repo
          imagePullPolicy: IfNotPresent
          name: my-application
          serviceAccountName: my-k8s-svc-acct
</code></pre>

<p><code>serviceAccountName</code> is a property of the pod spec object, not the container. So, it should be:</p>
<pre><code>spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-application
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: my-application
    spec:
      serviceAccountName: my-k8s-svc-acct
      containers:
        - image: &gt;-
            gcr.io/my-project/github.com/my-org/my-repo
          imagePullPolicy: IfNotPresent
          name: my-application
      
</code></pre>
