<p>I am spinning up a container (pod/Job) from a GKE.</p>

<p>I have set up the appropriate Service Account on the cluster's VMs.</p>

<p>Therefore, when I <strong>manually</strong> perform a <code>curl</code> to a specific CloudRun service endpoint, I can perform the request (and get authorized and have <code>200</code> in my response)</p>

<p>However, when I try to automate this by setting an image to run in a <code>Job</code> as follows, I get <code>401</code></p>

<pre><code>      - name:  pre-upgrade-job
        image: "google/cloud-sdk"
        args:
          - curl
          - -s
          - -X
          - GET
          - -H
          - "Authorization: Bearer $(gcloud auth print-identity-token)"
          - https://my-cloud-run-endpoint
</code></pre>

<p>Here are the logs on <code>Stackdriver</code></p>

<pre><code>{
 httpRequest: {
  latency: "0s"   
  protocol: "HTTP/1.1"   
  remoteIp: "gdt3:r787:ff3:13:99:1234:avb:1f6b"   
  requestMethod: "GET"   
  requestSize: "313"   
  requestUrl: "https://my-cloud-run-endpoint"   
  serverIp: "212.45.313.83"   
  status: 401   
  userAgent: "curl/7.59.0"   
 }
 insertId: "29jdnc39dhfbfb"  
 logName: "projects/my-gcp-project/logs/run.googleapis.com%2Frequests"  
 receiveTimestamp: "2019-09-26T16:27:30.681513204Z"  
 resource: {
  labels: {
   configuration_name: "my-cloud-run-service"    
   location: "us-east1"    
   project_id: "my-gcp-project"    
   revision_name: "my-cloudrun-service-d5dbd806-62e8-4b9c-8ab7-7d6f77fb73fb"    
   service_name: "my-cloud-run-service"    
  }
  type: "cloud_run_revision"   
 }
 severity: "WARNING"  
 textPayload: "The request was not authorized to invoke this service. Read more at https://cloud.google.com/run/docs/securing/authenticating"  
 timestamp: "2019-09-26T16:27:30.673565Z"  
}
</code></pre>

<p>My question is how can I see if an "Authentication" header does reach the endpoint (the logs do not enlighten me much) and if it does, whether it is appropriately rendered upon image command/args invocation.</p>

pkaramol
<p>In your Job, <code>gcloud auth print-identity-token</code> likely does not return any tocken.
The reason is that locally, gcloud uses your identity to mint a token, but in a Job, you are not logged into gcloud.</p>
