Workload Identity fails when service account bindings are incomplete, KSA annotations are missing, or IAM permissions are misconfigured. Pods cannot access Google Cloud APIs.
Workload Identity allows Kubernetes service accounts to impersonate Google Cloud service accounts. This error occurs when the binding between KSA and GSA is incomplete or misconfigured. Pods try to authenticate with Google Cloud APIs but fail because the trust relationship is not established or IAM permissions are missing.
First diagnostic step
Second diagnostic step
Third diagnostic step
Fourth diagnostic step
Additional notes and platform-specific considerations.
Failed to connect to server: connection refused (HTTP/2)
How to fix "HTTP/2 connection refused" error in Kubernetes
missing request for cpu in container
How to fix "missing request for cpu in container" in Kubernetes HPA
error: invalid configuration
How to fix "error: invalid configuration" in Kubernetes
Fifth diagnostic step