Workload Identity 403: Permission denied (GKE) Google Cloud / Firebase Origin: Platform & cloud Last updated 4 Nov 2026

GKE: google.api_core.exceptions.Forbidden: 403 Caller does not have required permission — Workload Identity: unable to generate access token

A pod tried to call Google APIs but its Kubernetes service account is not bound to a Google service account (or the binding lacks roles).

Exact message you may see Unable to generate access token; IAM returned 403iam.serviceAccounts.getAccessToken permission denied Workload IdentityWorkload Identity 403 Caller does not have required permission403 Permission iam.serviceAccounts.getAccessToken denied on resource
Explore the map of this error Full error map →
Seen on: Google Cloud Kubernetes

Meaning

Workload Identity needs: the cluster/node pool with Workload Identity enabled, a KSA annotated with the GSA email, and an IAM binding giving the KSA roles/iam.workloadIdentityUser on the GSA. Then the GSA must hold the API roles. Missing any step gives 403 or falls back to the node's default service account.

Common causes

  • Workload Identity not enabled on the node pool
  • KSA missing iam.gke.io/gcp-service-account annotation
  • No workloadIdentityUser binding
  • GSA lacks required roles on the target resource
  • Wrong namespace/KSA name in the binding member

⚡ Quick fix

  1. Annotate the KSA and bind it: gcloud iam service-accounts add-iam-policy-binding GSA --role roles/iam.workloadIdentityUser --member "serviceAccount:PROJECT.svc.id.goog[NAMESPACE/KSA]"
  2. Enable Workload Identity on the cluster and node pool
  3. Grant the GSA the needed API roles

Detailed fix by platform

kubectl

  1. kubectl annotate serviceaccount KSA -n NAMESPACE iam.gke.io/gcp-service-account=GSA@PROJECT.iam.gserviceaccount.com

How to diagnose

  1. Pool — Workload Identity on?
  2. Annotation — KSA annotated?
  3. Binding — workloadIdentityUser?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your c…Could not load the default credentials — Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started (Google Cloud / Firebase)Could not load the de…GKE Ingress: backends marked UNHEALTHY (502) — GKE Ingress: Some backend services are in UNHEALTHY state / 502 Server Error from the load balancer (Google Cloud / Firebase)GKE Ingress: backends…gke-gcloud-auth-plugin not found — kubectl: error: executable gke-gcloud-auth-plugin not found — it looks like you are trying to use a client-go credential plugin that is not installed (Google Cloud / Firebase)gke-gcloud-auth-plugi…GKE: 0/3 nodes are available: Insufficient cpu — GKE/Kubernetes: Pod unschedulable — 0/3 nodes are available: 3 Insufficient cpu (Google Cloud / Firebase)GKE: 0/3 nodes are av…GKE: Quota 'CPUS' exceeded — GKE/Compute: Quota 'CPUS' exceeded. Limit: 8.0 in region us-central1 (QUOTA_EXCEEDED) (Google Cloud / Firebase)GKE: Quota 'CPUS' exc…PERMISSION_DENIED: Permission 'x' denied on resource — Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist) (Google Cloud / Firebase)PERMISSION_DENIED: Pe…Your active project does not match the quota project in your local ADC — gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file (Google Cloud / Firebase)Your active project d…Workload …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.