While creating the GKE cluster, select the 'Allow full access to all Cloud APIs' option under ‘Access scopes‘.

Create a service account with access to Cloud Storage. Create a P12 key for the service account and use it as an imagePullSecrets in Kubernetes.

In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.

Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.