<p>I have created a spring boot project which connects with Cloud SQL(MySQL).
I have deployed this in google cloud (cloudrun) and it is working in it.</p>
<p>now, I am trying to deploy the same container image of spring boot app in kubernates enigne GKE and i am expecting this will connect with mysql cloud sql instance.
however, i am getting below errors in application POD logs.</p>
<hr />
<pre><code>     &quot;method&quot; : &quot;google.cloud.sql.v1beta4.SqlInstancesService.CreateEphemeral&quot;
      &quot;service&quot; : &quot;sqladmin.googleapis.com&quot;,
    &quot;metadata&quot; : {
    &quot;domain&quot; : &quot;googleapis.com&quot;,
    &quot;reason&quot; : &quot;ACCESS_TOKEN_SCOPE_INSUFFICIENT&quot;,
    &quot;@type&quot; : &quot;type.googleapis.com/google.rpc.ErrorInfo&quot;,
  &quot;details&quot; : [ {
  &quot;status&quot; : &quot;PERMISSION_DENIED&quot;,
  &quot;message&quot; : &quot;Request had insufficient authentication scopes.&quot;,
  } ],
    &quot;reason&quot; : &quot;insufficientPermissions&quot;
    &quot;message&quot; : &quot;Insufficient Permission&quot;,
    &quot;domain&quot; : &quot;global&quot;,
  &quot;errors&quot; : [ {
  &quot;code&quot; : 403,

Failed to create ephemeral certificate for the Cloud SQL instance.
</code></pre>
<hr />
<p>please help on this...what could be the solution</p>

jikar bhati
<p>Not sure how you are passing the service account file but you can pass it using the <strong>Kubernetes</strong> secret or use the <strong>Service account</strong> and attach it to deployment.</p>
<pre><code>kubectl create secret generic google-application-credentials --from-file=./application-credentials.json
</code></pre>
<p>Deployment volume in which secret get attached</p>
<pre><code>volumes:
- name: google-application-credentials-volume
  secret:
    secretName: google-application-credentials
    items:
    - key: application-credentials.json # default name created by the create secret from-file command
      path: application-credentials.json
</code></pre>
<p>Mount secret at the path</p>
<pre><code>spec:
  containers:
  - name: my-service
    volumeMounts:
    - name: google-application-credentials-volume
      mountPath: /etc/gcp
      readOnly: true
</code></pre>
<p>At last, you can pass the environment variables which will point to this file and cred</p>
<pre><code>spec:
  containers:
  - name: my-service
    env:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcp/application-credentials.json
</code></pre>
<p>Make sure your service account has sufficient role to update Cloud SQL.</p>
