How to push images to GCR from Drone inside GKE?

I’m trying to build and push images to GCR using plugins/gcr. Created GCP service account with Storage Admin role, createad a json key for it, and saved the key via Drone UI, and then referred to it in the .drone.yml step, but no luck:

+ /usr/local/bin/docker tag b8bcda0a2f37a9d77dd2efea8ecc25c02810ddef
+ /usr/local/bin/docker push
The push refers to repository []
03901b4a2ea8: Preparing
denied: Token exchange failed for project 'myproject. Caller does not have permission 'storage.buckets.get'. To configure permissions, follow instructions at:

Here’s the publish-step from .drone.yml:

- name: publish
  image: plugins/gcr
    - latest
      from_secret: service-account-key-name
    event: push
    branch: master

Any ideas?

It turns out the issue was not related to Drone but GCP. I had created multiple service accounts with same name but different roles, and it appears that GCP does some kind of caching which prevents overwriting previously created and deleted service accounts with different roles. Found the answer from here:

So, the solution was to create a new service account with different name.