<p>Problem  statement :</p>
<p>I  have  deployed  a  spring  boot  app  which  when  on  starting  always  uses  default  compute  engine  service  account  credentials to  authenticate  the  app ,  i  have  a  created  a  seperate  service  account  and  key  but  not  able  to  replace  the  default  one.  i  tried  specifying  the  new  service  account  in deployement.yaml  by  using  &quot;serviceAccountName&quot;  field  but  still  got  the  error  saying  service  account eg :&quot;xyz&quot; not  found.</p>
<p><strong>serviceAccountName: {{ .Values.serviceAccountName }}</strong></p>
<p>so  how  can  i  override  default  service  account of  compute  engine  with  a  specific  service  account  and  define  it  in  deployment.yaml.</p>
<p>if  i  add  the  credentials  of  new  service  account  in  app  code  base  it  will  work  but  that  is  not  a  best  practice  to  do  so ,  please  someone  help  me  on  resolving  this  issue</p>
<p>snippet  of  my  deployment.yaml  file:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: helloworld
    appVersion: {{ .Values.appVersion }}
  name: helloworld
spec:
  replicas: 1
  selector:
    matchLabels:
      app: helloworld
  template:
    metadata:
      labels:
        app: helloworld
        environment: {{ .Values.environment }}
    spec:
      containers:
        - name: helloworld
          image: {{ .Values.imageSha }}
          imagePullPolicy: Always
          securityContext:
            allowPrivilegeEscalation: false
            runAsUser: 1000
          ports:
            - containerPort: 8080
          env:
          - name: SPRING_CONFIG_LOCATION
            value: &quot;/app/deployments/config/&quot;          
          volumeMounts:
            - name: application-config
              mountPath: &quot;/app/deployments/config&quot;
              readOnly: true
      volumes:
      - name: application-config
        configMap:
          name: {{ .Values.configMapName }}
          items:
          - key: application.properties
            path: application.properties
</code></pre>

Spiriter_rider
<p>I think you should use <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">Workload Identity</a> which allows to access <code>Google Cloud</code> from outside.</p>
<blockquote>
<p>Workload Identity is the recommended way to access Google Cloud services from applications running within GKE due to its improved security properties and manageability. For information about alternative ways to access Google Cloud APIs from GKE, refer to the alternatives section below.</p>
</blockquote>
<p>Above guide is well described and I think it should resolve your issue.</p>
<p>For additional example, you can check one of the Community Tutorial - <a href="https://cloud.google.com/community/tutorials/gke-workload-id-clientserver" rel="nofollow noreferrer">Using Kubernetes Workload Identity for client-server authorization</a>.</p>
<blockquote>
<p>In GKE, the Workload Identity feature allows these identities to also be associated with IAM service accounts. This allows a pod running as a Kubernetes service account to act as the associated service account for authorized access to Google APIs and to services that verify identity based on Google Cloud-specific OIDC.</p>
</blockquote>
<p>Both docs have examples which should help you to adjust <code>Workload Identity</code> to your needs.</p>
