<p>I'm trying to use the standalone <code>gsutil</code> tool from within a container running in a GKE cluster, but I cannot get it to work. I believe the cluster has adequate permissions (see below). However, running</p>

<pre><code>./gsutil ls gs://my-bucket/
</code></pre>

<p>yields</p>

<pre><code>ServiceException: 401 Anonymous users does not have storage.objects.list access to bucket my-bucket.
</code></pre>

<p>Am I missing anything? I don't have a <code>.boto</code> file, as I believe it shouldn't be necessary—or is it? This is the list of scopes that the cluster and the node pool have:</p>

<pre><code>- https://www.googleapis.com/auth/compute
- https://www.googleapis.com/auth/devstorage.full_control
- https://www.googleapis.com/auth/logging.write
- https://www.googleapis.com/auth/monitoring.write
- https://www.googleapis.com/auth/pubsub
- https://www.googleapis.com/auth/servicecontrol
- https://www.googleapis.com/auth/service.management.readonly
- https://www.googleapis.com/auth/trace.append
</code></pre>

<p>You can use gsutil inside a docker container on GKE with a <a href="https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account" rel="noreferrer">service account</a>, or with your own credentials.</p>

<p><strong>Service Account</strong></p>

<p><strong>1)</strong> Add the <code>service-account.json</code> file to your project.</p>

<p><strong>2)</strong> Add a <code>.boto</code> file to your project pointing to the <code>service-account.json</code> file:</p>

<pre><code>[Credentials]
gs_service_key_file = /path/to/service-account.json
</code></pre>

<p><strong>3)</strong> In your Dockerfile, set the <code>BOTO_CONFIG</code> environment variable to point to this <code>.boto</code> file:</p>

<pre><code>ENV BOTO_CONFIG=/path/to/.boto
</code></pre>

<p><br/><strong>Own Credentials</strong></p>

<p><strong>1)</strong> Locally, run gcloud auth login. A <code>.boto</code> file will be created at <em>~/.config/gcloud/legacy_credentials/your@account.com/.boto</em> with the following structure:</p>

<pre><code>[OAuth2]
client_id = &lt;id&gt;.apps.googleusercontent.com
client_secret = &lt;secret&gt;

[Credentials]
gs_oauth2_refresh_token = &lt;token&gt;
</code></pre>

<p><strong>2)</strong> Copy this <code>.boto</code> file into your project</p>

<p><strong>3)</strong> In your Dockerfile, set the <code>BOTO_CONFIG</code> environment variable to point to this <code>.boto</code> file:</p>

<pre><code>ENV BOTO_CONFIG=/path/to/.boto
</code></pre>

<p><br/><em>I installed standalone gsutil in the docker container using pip install gsutil</em></p>
