<p>I am spinning up a container (pod/Job) from a GKE.</p>

<p>I have set up the appropriate Service Account on the cluster's VMs.</p>

<p>Therefore, when I <strong>manually</strong> perform a <code>curl</code> to a specific CloudRun service endpoint, I can perform the request (and get authorized and have <code>200</code> in my response)</p>

<p>However, when I try to automate this by setting an image to run in a <code>Job</code> as follows, I get <code>401</code></p>

<pre><code>      - name:  pre-upgrade-job
        image: "google/cloud-sdk"
        args:
          - curl
          - -s
          - -X
          - GET
          - -H
          - "Authorization: Bearer $(gcloud auth print-identity-token)"
          - https://my-cloud-run-endpoint
</code></pre>

<p>Here are the logs on <code>Stackdriver</code></p>

<pre><code>{
 httpRequest: {
  latency: "0s"   
  protocol: "HTTP/1.1"   
  remoteIp: "gdt3:r787:ff3:13:99:1234:avb:1f6b"   
  requestMethod: "GET"   
  requestSize: "313"   
  requestUrl: "https://my-cloud-run-endpoint"   
  serverIp: "212.45.313.83"   
  status: 401   
  userAgent: "curl/7.59.0"   
 }
 insertId: "29jdnc39dhfbfb"  
 logName: "projects/my-gcp-project/logs/run.googleapis.com%2Frequests"  
 receiveTimestamp: "2019-09-26T16:27:30.681513204Z"  
 resource: {
  labels: {
   configuration_name: "my-cloud-run-service"    
   location: "us-east1"    
   project_id: "my-gcp-project"    
   revision_name: "my-cloudrun-service-d5dbd806-62e8-4b9c-8ab7-7d6f77fb73fb"    
   service_name: "my-cloud-run-service"    
  }
  type: "cloud_run_revision"   
 }
 severity: "WARNING"  
 textPayload: "The request was not authorized to invoke this service. Read more at https://cloud.google.com/run/docs/securing/authenticating"  
 timestamp: "2019-09-26T16:27:30.673565Z"  
}
</code></pre>

<p>My question is how can I see if an "Authentication" header does reach the endpoint (the logs do not enlighten me much) and if it does, whether it is appropriately rendered upon image command/args invocation.</p>

<p>In your job you use this container <code>google/cloud-sdk</code> which is a from scratch installation of <code>gcloud</code> tooling. It's generic, without any customization.</p>

<p>When you call this <code>$(gcloud auth print-identity-token)</code> you ask for the identity token of the service account configured in the <code>gcloud</code> tool.</p>

<p>If we put together this 2 paragraphs, you want to generate an identity token from a generic/blank installation of <code>gcloud</code> tool. By the way, you don't have defined service account in your <code>gcloud</code> and your token is empty (like @johnhanley said).</p>

<p>For solving this issue, add an environment variable like this</p>

<pre><code>env: 
  - GOOGLE_APPLICATION_CREDENTIAL=&lt;path to your credential.json&gt;
</code></pre>

<p>I don't know where is your current <code>credential.json</code> of your running environment. Try to perform an <code>echo</code> of this env var to find it and forward it correctly to your <code>gcloud</code> job.</p>

<p>If you are on compute engine or similar system compliant with metadata server, you can get a correct token with this command:</p>

<pre><code>curl  -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=&lt;URL of your service&gt;"
</code></pre>

<p><strong>UPDATE</strong></p>

<p>Try to run your command outside of the <code>gcloud</code> container. Here the update of your job</p>

<pre><code> - name:  pre-upgrade-job
        image: "google/cloud-sdk"
        entrypoint: "bash"
        args:
          - -c
          - "curl -s -X GET -H \"Authorization: Bearer $(gcloud auth print-identity-token)\" https://my-cloud-run-endpoint"
</code></pre>

<p>Not sure that works. Let me know</p>
