I have GKE cluster that uses a custom service-account. I’m using it to access Google API (Gmail API). But, when I use

final List<String> SCOPES = List.of(GmailScopes.GMAIL_READONLY);
GoogleCredentials delegatedCredentials = GoogleCredentials.getApplicationDefault()
                    .createScoped(SCOPES)
                    .createDelegated(user);
return new Gmail.Builder(HTTP_TRANSPORT, JSON_FACTORY, new HttpCredentialsAdapter(delegatedCredentials)).setApplicationName("Gmail-App").build();

I expected delegatedCredentials to be the attached GKE service account ServiceAccountCredentials. However, it returns a ComputeEngineCredentials which is likely the default SA that comes up with GKE. So, this causes permissions/roles issues for the next Google API calls.

I setup KSA in the deployment.yaml kubernetes config file. I create the KSA file using terraform and assign it whatever role is needed.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-services-deployment
spec:
  selector:
    matchLabels:
      app: my-services
  template:
    metadata:
      labels:
        app: my-services
    spec:
      serviceAccountName: my-develop-services-ksa

I’ve verified that service account my-develop-services-ksa@ is attached to the pods.

I want to keep using a dedicated service account where I can customize roles for it rather than attaching roles to the default GKE SA.

As a workaround, when/if I use the service account file to load the GoogleCredentials from service-account stream (file/byte), then it works as expected.

GoogleCredentials googleCredentials = GoogleCredentials
                    .fromStream(serviceAccountStream)
                    .createScoped(SCOPES).createDelegated(user);
return new Gmail.Builder(HTTP_TRANSPORT, JSON_FACTORY, new HttpCredentialsAdapter(delegatedCredentials)).setApplicationName("Gmail-App").build();

How can I solve this?