I created a simple Argo job to pull messages from a Google Cloud Pub/Sub topic. Permission has been given to the service account of GKE’s workload identity. But the Argo job failed with errors:

Shell
Console

Thanks to my colleagues. They remind me that an Argo job needs to specify a service account when running in the workload identity namespace.

Shell

Or, I can add this service account to the YAML file:

YAML