<p>I am using k8s go client (<a href="https://github.com/kubernetes/client-go" rel="nofollow noreferrer">https://github.com/kubernetes/client-go</a>) to create jobs on GKE cluster (the code is running inside a pod). But I am having this error:</p>
<pre><code>{
  &quot;error&quot;: &quot;2 UNKNOWN: jobs.batch is forbidden: User \&quot;system:serviceaccount:default:default\&quot; cannot create resource \&quot;jobs\&quot; in API group \&quot;batch\&quot; in the namespace \&quot;default\&quot;&quot;
}
</code></pre>
<p>Looks like I am using <code>system:serviceaccount:default:default</code>, but how can I use a GCP IAM account instead?</p>
<p>I have already set up GOOGLE_APPLICATION_CREDENTIALS
following <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform</a>. But looks like it only works with GCP client not with k8s client</p>

Zhixin Wen
<p>You probably want to use the <a href="https://github.com/kubernetes/client-go/blob/20923fd71b14d068ee301eaf1c5320178b9ba585/plugin/pkg/client/auth/gcp/gcp.go#L58" rel="nofollow noreferrer">gcpAuthProvider plugin</a> when creating the <a href="https://godoc.org/k8s.io/client-go/kubernetes/typed/authentication/v1#New" rel="nofollow noreferrer">auth client</a>.</p>
