<p>We created the GKE cluster with the <strong>public</strong> endpoint. The <strong>service account</strong> of the GKE <strong>cluster</strong> and <strong>Node pool</strong> has the following roles.</p>
<pre><code>&quot;roles/compute.admin&quot;,
&quot;roles/compute.viewer&quot;,
&quot;roles/compute.securityAdmin&quot;,
&quot;roles/iam.serviceAccountUser&quot;,
&quot;roles/iam.serviceAccountAdmin&quot;,
&quot;roles/resourcemanager.projectIamAdmin&quot;,
&quot;roles/container.admin&quot;,
&quot;roles/artifactregistry.admin&quot;,
&quot;roles/storage.admin&quot;
</code></pre>
<p>The node pool of the GKE cluster has the following <strong>OAuth scopes</strong></p>
<pre><code>&quot;https://www.googleapis.com/auth/cloud-platform&quot;,
&quot;https://www.googleapis.com/auth/devstorage.read_write&quot;,
</code></pre>
<p>The <strong>private</strong> GCS bucket has the same service account as the principal, with the <strong>storage admin</strong> role.</p>
<p>When we try to read/write in this bucket from a GKE POD, we get the below error.</p>
<pre><code># Read
AccessDeniedException: 403 Caller does not have storage.objects.list access to the Google Cloud Storage bucket

# Write
AccessDeniedException: 403 Caller does not have storage.objects.create access to the Google Cloud Storage object
</code></pre>
<p>We also checked this <a href="https://stackoverflow.com/questions/46497002/gcs-write-access-from-inside-a-gke-pod">thread</a> but the solution was credential oriented and couldn't help us. <strong>We would like to read/write without maintaining the SA auth key or any sort of credentials</strong>.</p>
<p>Please guide what is missing here.</p>
<hr />
<p><strong>UPDATE</strong>: as per the suggestion by @boredabdel we checked and found that <code>workload identity</code> was already enabled on the GKE cluster as well as NodePool. We are using this <a href="https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/beta-private-cluster" rel="nofollow noreferrer">module</a> to create our cluster where it is already enabled by default. Still, we are facing connectivity issues.</p>
<p><strong>Cluster</strong>
Security:</p>
<p><a href="https://i.stack.imgur.com/oEeIW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oEeIW.png" alt="enter image description here" /></a></p>
<p><strong>NodePool</strong>
Security:</p>
<p><a href="https://i.stack.imgur.com/MH0Fw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MH0Fw.png" alt="enter image description here" /></a></p>

Nitin G
<p>Seems like you are trying to use the Node Service Account to authenticate to GCS. You need to passe the Service Account Key to the app you are calling the API from as described in this <a href="https://cloud.google.com/docs/authentication/production#automatically" rel="nofollow noreferrer">doc</a></p>
<p>If you want Keyless authentication, my advice is to use <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">Workload identity</a></p>
