How to fix Error authenticating with Workload Identity: unable to generate access token in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 133 views

Workload Identity fails when service account bindings are incomplete, KSA annotations are missing, or IAM permissions are misconfigured. Pods cannot access Google Cloud APIs.

Quick fix

Fixes Error authenticating with Workload Identity: unable to generate access token

  1. Step 1
  2. Step 2
  3. Step 3
  4. Step 4
  5. Step 5
kubernetes — error
# Error authenticating with Workload Identity: unable to generate access token
Error authenticating with Workload Identity: unable to generate access token

What this error means

Workload Identity allows Kubernetes service accounts to impersonate Google Cloud service accounts. This error occurs when the binding between KSA and GSA is incomplete or misconfigured. Pods try to authenticate with Google Cloud APIs but fail because the trust relationship is not established or IAM permissions are missing.

Typical symptoms

  • Pods fail to authenticate with Google Cloud services
  • Error: "unable to generate access token" in pod logs
  • gcloud CLI inside pods returns "gcloud: command not found" or auth errors
  • Application fails with permission denied accessing GCS, BigQuery, or other Google APIs
  • Workload Identity webhook pod not running or crashing
  • Service account annotations show in pod spec but authentication still fails
  • Different error per pod: some succeed, others fail

Common causes

  1. KSA (Kubernetes service account) not annotated with GSA email
  2. GSA (Google service account) missing IAM bindings to KSA
  3. Workload Identity webhook not enabled or not running
  4. Namespace missing Workload Identity annotation
  5. IAM role insufficient for required API operations
  6. KSA and GSA in different projects without cross-project trust
  7. Pod spec not using correct service account

How to fix "Error authenticating with Workload Identity: unable to generate access token"

1Step 1

First diagnostic step

2Step 2

Second diagnostic step

3Step 3

Third diagnostic step

4Step 4

Fourth diagnostic step

5Step 5

Fifth diagnostic step

Advanced notes

Additional notes and platform-specific considerations.

Frequently asked questions

What does "Error authenticating with Workload Identity: unable to generate access" mean?
Workload Identity allows Kubernetes service accounts to impersonate Google Cloud service accounts. This error occurs when the binding between KSA and GSA is incomplete or misconfigured. Pods try to authenticate with Google Cloud APIs but fail because the trust relationship is not established or IAM permissions are missing.
How do I fix "Error authenticating with Workload Identity: unable to generate access"?
Workload Identity fails when service account bindings are incomplete, KSA annotations are missing, or IAM permissions are misconfigured. Pods cannot access Google Cloud APIs.
What causes "Error authenticating with Workload Identity: unable to generate access"?
KSA (Kubernetes service account) not annotated with GSA email GSA (Google service account) missing IAM bindings to KSA Workload Identity webhook not enabled or not running
Is the "Error authenticating with Workload Identity: unable to generate access" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading