<p>I am trying to bind my Google Service Account (GSA) to my Kubernetes Service Account (KSA) so I can connect to my Cloud SQL database from the Google Kubernetes Engine (GKE). I am currently using the follow guide provided in Google's documentation (<a href="https://cloud.google.com/sql/docs/sqlserver/connect-kubernetes-engine" rel="nofollow noreferrer">https://cloud.google.com/sql/docs/sqlserver/connect-kubernetes-engine</a>).</p>
<p>Currently I have a cluster running on GKE named <code>MY_CLUSTER</code>, a GSA with the correct Cloud SQL permissions named <code>MY_GCP_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com</code>, and a KSA named <code>MY_K8S_SERVICE_ACCOUNT</code>. I am trying to bind the two accounts using the following command.</p>
<pre><code>gcloud iam service-accounts add-iam-policy-binding \
  --member &quot;serviceAccount:PROJECT_ID.svc.id.goog[K8S_NAMESPACE/MY_K8S_SERVICE_ACCOUNT]&quot; \
  --role roles/iam.workloadIdentityUser \
  MY_GCP_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com
</code></pre>
<p>However when I run the previous command I get the following error message.</p>
<pre><code>ERROR: Policy modification failed. For a binding with condition, run &quot;gcloud alpha iam policies lint-condition&quot; to identify issues in condition.
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Identity Pool does not exist (PROJECT_ID.svc.id.goog). Please check that you specified a valid resource name as returned in the `name` attribute in the configuration API.
</code></pre>
<p>Why am I getting this error when I try to bind my GSA to my KSA?</p>

Riley Conrardy
<p>In order to bind your Google Service Account (GSA) to you Kubernetes Service Account (KSA) you need to enable Workload Identity on the cluster. This is explained in more details in Google's documentation (<a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a>).</p>
<p>To enable Workload Identity on an existing cluster you can run.</p>
<pre><code>gcloud container clusters update MY_CLUSTER \
  --workload-pool=PROJECT_ID.svc.id.goog
</code></pre>
