<p>I am trying to configure my GKE cluster to pull from a private GCR repo in the same project. I am not using OAuth scopes but have associated a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa" rel="noreferrer">least privilege service account</a> with the default node pool and provided it with the <code>roles/storage.objectViewer</code> permission.</p>

<p>However, I am still receiving the following when trying to access this image:
<code>
Failed to pull image "eu.gcr.io/&lt;project&gt;/&lt;image&gt;": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
</code></p>

<p>Do I also need to configure <a href="https://container-solutions.com/using-google-container-registry-with-kubernetes/" rel="noreferrer"><code>imagePullSecrets</code></a> or should the <code>roles/storage.objectViewer</code> permission be sufficient?</p>

<p>The root cause of this issue was not setting access (OAuth) scopes on the cluster instances preventing the service account from working as intended.</p>
<p>From the GCP docs about <a href="https://cloud.google.com/compute/docs/access/service-accounts#usingroles" rel="noreferrer">Compute service accounts</a> :</p>
<blockquote>
<p><strong>You must set access scopes on the instance to authorize access.</strong></p>
<p>You cannot set only IAM roles on the service account and omit access scopes when creating the virtual machine instance. The level of access a service account has is determined by a combination of access scopes and IAM roles so you must configure both access scopes and IAM roles for the service account to work properly.</p>
</blockquote>
<p>The minimal scopes required when accessing private images in GCR can be found <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#reduce_node_sa_scopes" rel="noreferrer">here</a> with the meaning of these scopes found <a href="https://developers.google.com/identity/protocols/googlescopes" rel="noreferrer">here</a>. A least privilege service account for the cluster nodes can then be created following the instructions <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa" rel="noreferrer">here</a>.</p>
<p>As described <a href="https://cloud.google.com/compute/docs/access/service-accounts#service_account_permissions" rel="noreferrer">here</a> an alternative would be to only grant the <code>https://www.googleapis.com/auth/cloud-platform</code> scope to the cluster nodes which authorises access to all Cloud Platform services and then limit access through IAM roles on node service accounts.</p>
<p>By configuring the cluster nodes as above, <code>imagePullSecrets</code> are not required for pulling private images from GCR in the same project.</p>
