<p>I'm attempting to get Config Connector up and running on my GKE project and am following <a href="https://cloud.google.com/config-connector/docs/how-to/getting-started" rel="nofollow noreferrer">this getting started guide.</a></p>
<p>So far I have enabled the appropriate APIs:</p>
<pre><code>&gt; gcloud services enable cloudresourcemanager.googleapis.com
</code></pre>
<p>Created my service account and added policy binding:</p>
<pre><code>&gt; gcloud iam service-accounts create cnrm-system
&gt; gcloud iam service-accounts add-iam-policy-binding ncnrm-system@test-connector.iam.gserviceaccount.com --member=&quot;serviceAccount:test-connector.svc.id.goog[cnrm-system/cnrm-controller-manager]&quot; --role=&quot;roles/iam.workloadIdentityUser&quot;
&gt; kubectl wait -n cnrm-system --for=condition=Ready pod --all
</code></pre>
<p>Annotated my namespace:</p>
<pre><code>&gt; kubectl annotate namespace default cnrm.cloud.google.com/project-id=test-connector
</code></pre>
<p>And then run through trying to apply the Spanner yaml in the example:</p>
<pre><code>~ &gt;&gt;&gt; kubectl describe spannerinstance spannerinstance-sample                                                                                                                                                                                                                            
Name:         spannerinstance-sample
Namespace:    default
Labels:       label-one=value-one
Annotations:  cnrm.cloud.google.com/management-conflict-prevention-policy: resource
              cnrm.cloud.google.com/project-id: test-connector
API Version:  spanner.cnrm.cloud.google.com/v1beta1
Kind:         SpannerInstance
Metadata:
  Creation Timestamp:  2020-09-18T18:44:41Z
  Generation:          2
  Resource Version:    5805305
  Self Link:           /apis/spanner.cnrm.cloud.google.com/v1beta1/namespaces/default/spannerinstances/spannerinstance-sample
  UID:                 
Spec:
  Config:        northamerica-northeast1-a
  Display Name:  Spanner Instance Sample
  Num Nodes:     1
Status:
  Conditions:
    Last Transition Time:  2020-09-18T18:44:41Z
    Message:               Update call failed: error fetching live state: error reading underlying resource: Error when reading or editing SpannerInstance &quot;test-connector/spannerinstance-sample&quot;: googleapi: Error 403: Request had insufficient authentication scopes.
    Reason:                UpdateFailed
    Status:                False
    Type:                  Ready
Events:
  Type     Reason        Age                      From                        Message
  ----     ------        ----                     ----                        -------
  Warning  UpdateFailed  6m41s        spannerinstance-controller  Update call failed: error fetching live state: error reading underlying resource: Error when reading or editing SpannerInstance &quot;test-connector/spannerinstance-sample&quot;: googleapi: Error 403: Request had insufficient authentication scopes.
</code></pre>
<p>I'm not really sure what's going on here, because my cnrm service account has ownership of the project my cluster is in, and I have the APIs listed in the guide enabled.</p>
<p>The CC pods themselves appear to be healthy:</p>
<pre><code>~ &gt;&gt;&gt; kubectl wait -n cnrm-system --for=condition=Ready pod --all                                                                                                                                                                                                                    
pod/cnrm-controller-manager-0 condition met
pod/cnrm-deletiondefender-0 condition met
pod/cnrm-resource-stats-recorder-58cb6c9fc-lf9nt condition met
pod/cnrm-webhook-manager-7658bbb9-kxp4g condition met
</code></pre>
<p>Any insight in to this would be greatly appreciated!</p>

<p>By the error message you have posted, I should supposed that it might be an error in your <a href="https://cloud.google.com/compute/docs/access/service-accounts#accesscopesiam" rel="nofollow noreferrer">GKE scopes</a>.</p>
<p>To GKE access others GCP APIs you must allow this access when creating the cluster. You can check the enabled scopes with the command:</p>
<p><code>gcloud container clusters describe &lt;cluster-name&gt;</code> and find in the result for <code>oauthScopes</code>.</p>
<p><a href="https://developers.google.com/identity/protocols/oauth2/scopes#spanner" rel="nofollow noreferrer">Here</a> you can see the scope's name for Cloud Spanner, you must enable the scope <code>https://www.googleapis.com/auth/cloud-platform</code> as minimum permission.</p>
<p>To verify in the GUI, you can see the permission in: <code>Kubernetes Engine</code> &gt; <code>&lt;Cluster-name&gt;</code> &gt; expand the section <code>permissions</code> and find for <code>Cloud Platform</code></p>
