<p>I'm working on some GCP apps which are dockerized in a Kubernetes cluster in GCP (I'm new to Docker and Kubernetes). In order to access some of the GCP services, the environment variable GOOGLE_APPLICATION_CREDENTIALS needs to point to a credentials file.<br/> 
<strong>Should the environment variable be set and that file included in:<br/> 
- each of the Docker images?<br/>
- the Kubernetes cluster?</strong><br/></p>

<p><strong>GCP specific stuff</strong><br/>
This is the actual error: com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Request had insufficient authentication scopes.</p>

<p><strong>-Should the environment variable be set and that file included in:<br/> 
- each of the Compute Engine instances? 
- the main GCP console?</strong></p>

<p>And, most importantly, HOW? 
:)</p>

<p>You'll need to create a service account (IAM &amp; Admin > Service Accounts), generate a key for it in JSON format and then give it the needed permissions (IAM &amp; Admin > IAM). If your containers need access to this, it's best practice to add it as a secret in kubernetes and mount it in your containers. Then set the environment variable to point to the secret which you've mounted:</p>

<p>export GOOGLE_APPLICATION_CREDENTIALS="[PATH_TO_SECRET]"</p>

<p>This page should get you going:  <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform#step_4_import_credentials_as_a_secret" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform#step_4_import_credentials_as_a_secret</a></p>
