<p>I am trying to use Google's preferred &quot;Workload Identity&quot; method to enable my GKE app to securely access secrets from Google Secrets.</p>
<p>I've completed the setup and even checked all steps in the Troubleshooting section (<a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity?hl=sr-ba#troubleshooting" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity?hl=sr-ba#troubleshooting</a>) <strong>but I'm still getting the following error in my logs</strong>:</p>
<blockquote>
<p>Unhandled exception. Grpc.Core.RpcException:
Status(StatusCode=PermissionDenied, Detail=&quot;Permission
'secretmanager.secrets.list' denied for resource
'projects/my-project' (or it may not exist).&quot;)</p>
</blockquote>
<p>I figured the problem was due to the node pool not using the correct service account, so I recreated it, this time specifying the correct service account.</p>
<p>The service account has the following roles added:</p>
<ul>
<li>Cloud Build Service</li>
<li>Account Kubernetes Engine Developer</li>
<li>Container Registry Service Agent</li>
<li>Secret Manager Secret Accessor</li>
<li>Secret Manager Viewer</li>
</ul>
<p>The relevant source code for the package I am using to authenticate is as follows:</p>
<pre><code>var data = new Dictionary&lt;string, string&gt;(StringComparer.OrdinalIgnoreCase);

var request = new ListSecretsRequest
{
    ParentAsProjectName = ProjectName.FromProject(projectName),
};

var secrets = secretManagerServiceClient.ListSecrets(request);
foreach(var secret in secrets)
{
    var value = secretManagerServiceClient.AccessSecretVersion($&quot;{secret.Name}/versions/latest&quot;);
    string secretVal = this.manager.Load(value.Payload);
    string configKey = this.manager.GetKey(secret.SecretName);
    data.Add(configKey, secretVal);
}
Data = data;
</code></pre>
<p>Ref. <a href="https://github.com/jsukhabut/googledotnet" rel="nofollow noreferrer">https://github.com/jsukhabut/googledotnet</a></p>
<p>Am I missing a step in the process?</p>
<p>Any idea why Google is still saying &quot;Permission 'secretmanager.secrets.list' denied for resource 'projects/my-project' (or it may not exist)?&quot;</p>

user1477388
<p>Like @sethvargo mentioned in the comments, you need to map the service account to your pod because <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity?hl=sr-ba#overview" rel="nofollow noreferrer">Workload Identity</a> doesn’t use the underlying node identity and instead maps a Kubernetes service account to a GCP service account. Everything happens at the per-pod level in Workload identity.</p>
<p>Assign a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to" rel="nofollow noreferrer">Kubernetes service account</a> to the application and configure it to act as a Google service account.</p>
<p>1.Create a GCP service account with the required permissions.</p>
<p>2.Create a Kubernetes service account.</p>
<p>3.Assign the Kubernetes service account permission to impersonate the GCP
service account.</p>
<p>4.Run your workload as the Kubernetes service account.</p>
<p>Hope you are using project ID instead of project name in the project or secret.</p>
<p>You cannot update the service account of an already created pod.</p>
<p>Refer the <a href="https://dzone.com/articles/enabling-gke-workload-identity" rel="nofollow noreferrer">link</a> to add service account to the pods.</p>
