<p>According to "<a href="https://cloud.google.com/docs/authentication/production#finding_credentials_automatically" rel="nofollow noreferrer">Finding credentials automatically</a>" from Google Cloud:</p>

<blockquote>
  <p>...ADC (Application Default Credentials) is able to implicitly find the credentials as long as the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, <strong>or as long as the application is running on</strong> Compute Engine, <strong>GKE</strong>, App Engine, or Cloud Functions.</p>
</blockquote>

<p>Do I understand correctly that <code>GOOGLE_APPLICATION_CREDENTIALS</code> does not need to be present, if I want to call Google Cloud APIs in current Google Cloud project?</p>

<p>Let's say I'm in a container in a pod, what can I do from within acontainer to test that calling Google Cloud APIs just work™?</p>

oldhomemovie
<p>Check out <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a> for how to up permissions for your pods. You have to do some mapping a so Google knows which pods get which perks, but after that it’s auto-magic as you mentioned. Otherwise calls will use the node-level google permissions which are generally minimal.</p>
