A signed GCS URL got 'SignatureDoesNotMatch'. the URL signed by a service with workload identity

Question

In a workload identity enabled GKE cluster, a service signed a GCS file but got: 'SignatureDoesNotMatch' after about 10 days.

Does the system-managed private key rotation cause it?

What should I do to resolve it?

Answer 1

You could review your expiration days assigned at your URL, in the following example is set to 3 days (days signurl -d 3d) also if you are using the flag -u in your command to generate the URL you could try to remove it as a workaround