我需要为GKE节点池配置什么最小权限才能从同一项目中的私有GCR repo中提取?

least privilege service account 并为其提供了 roles/storage.objectViewer

但是,在尝试访问此图像时,我仍收到以下消息: Failed to pull image "eu.gcr.io/<project>/<image>": rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

我还需要配置吗 imagePullSecrets 角色/storage.objectViewer 允许就足够了吗?