diff --git a/deploy/kubernetes/node.yaml b/deploy/kubernetes/node.yaml
index 145d2bf3b..747e7c4e6 100644
--- a/deploy/kubernetes/node.yaml
+++ b/deploy/kubernetes/node.yaml
@@ -42,6 +42,8 @@ spec:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--nodeid=$(KUBE_NODE_NAME)"
           env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: "/etc/cloud-sa/cloud-sa.json"
             - name: CSI_ENDPOINT
               value: unix:/csi/csi.sock
             - name: KUBE_NODE_NAME
@@ -56,6 +58,9 @@ spec:
               mountPath: /csi
             - name: device-dir
               mountPath: /host/dev
+            - name: cloud-sa-volume
+              readOnly: true
+              mountPath: "/etc/cloud-sa"
       volumes:
         # TODO(dependency): this will work when kublet registrar functionality exists
         #- name: registrar-socket-dir
@@ -74,3 +79,6 @@ spec:
           hostPath:
             path: /dev
             type: Directory
+        - name: cloud-sa-volume
+          secret:
+            secretName: cloud-sa