The action is failing with the following error… “google-github-actions/get-gke-credentials failed with: required “container.clusters.get” permission(s)“. I’m not using a service account.

I’m using the “Direct Workload Identity Federation” option as described by the google-github-actions/auth action. I also created my Workload Identity Pool and Provider according to their instructions. All of the help I’m reading talks about service accounts, but the auth action is clear that the “Direct Workload Identity Federation” option does not require a service account.

from the google-github-actions/auth documentation…

    service_account: (Optional) Email address or unique identifier of the Google Cloud service account for which to impersonate and generate credentials. 

Without this input, the GitHub Action will use Direct Workload Identity Federation

Action YAML

name: deploy-k8s-manifests

on:
  push:
    branches:
      - dev
    paths:
      - 'k8s/**'

jobs:
  deploy:
    runs-on: ubuntu-latest

    # Add "id-token" with the intended permissions.
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Get code
        uses: actions/checkout@v4

      - name: Authenticate with GCP
        id: 'auth'
        uses: google-github-actions/auth@v2
        with:
          project_id: 'my-project'
          workload_identity_provider: 'projects/297600345299/locations/global/workloadIdentityPools/github/providers/my-provider'

      - name: Get GKE credentials
        id: 'get-credentials'
        uses: google-github-actions/get-gke-credentials@v2
        with:
          cluster_name: 'preprod'
          location: 'us-central1'

      - name: Apply k8s manifests in GCP
        run: kubectl apply -f k8s

Log output

Authenticate with GCP
Run google-github-actions/auth@v2
Created credentials file at "/home/runner/work/my-project/my-project/gha-creds-c9c4d62169250d9a.json"

Get GKE credentials
Run google-github-actions/get-gke-credentials@v2
Error: google-github-actions/get-gke-credentials failed with: required "container.clusters.get" permission(s) for "projects/my-project/locations/us-central1/clusters/preprod".

Any help will be greatly appreciated.