Traceback (most recent call last):
  File "/storage-initializer/scripts/initializer-entrypoint", line 14, in  module 
    kserve.Storage.download(src_uri, dest_path)
  File "/usr/local/lib/python3.7/site-packages/kserve/storage.py", line 67, in download
    Storage._download_gcs(uri, out_dir)
  File "/usr/local/lib/python3.7/site-packages/kserve/storage.py", line 152, in _download_gcs
    for blob in blobs:
  File "/usr/local/lib/python3.7/site-packages/google/api_core/page_iterator.py", line 212, in _items_iter
    for page in self._page_iter(increment=False):
  File "/usr/local/lib/python3.7/site-packages/google/api_core/page_iterator.py", line 243, in _page_iter
    page = self._next_page()
  File "/usr/local/lib/python3.7/site-packages/google/api_core/page_iterator.py", line 372, in _next_page
    response = self._get_next_page_response()
  File "/usr/local/lib/python3.7/site-packages/google/api_core/page_iterator.py", line 432, in _get_next_page_response
    method=self._HTTP_METHOD, path=self.path, query_params=params
  File "/usr/local/lib/python3.7/site-packages/google/cloud/storage/_http.py", line 78, in api_request
    return call()
  File "/usr/local/lib/python3.7/site-packages/google/api_core/retry.py", line 290, in retry_wrapped_func
    on_error=on_error,
  File "/usr/local/lib/python3.7/site-packages/google/api_core/retry.py", line 188, in retry_target
    return target()
  File "/usr/local/lib/python3.7/site-packages/google/cloud/_http.py", line 479, in api_request
    raise exceptions.from_http_response(response)
google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/akerbp-kubeflow-core-kfp/o?projection=noAcl&prefix=models%2Fxgboost_lithology%2Fmodel.bst%2F&prettyPrint=false: Caller does not have storage.objects.list access to the Google Cloud Storage bucket.

kind: Namespace
apiVersion: v1
metadata:
  name: kfserving-test
  labels:
    serving.kubeflow.org/inferenceservice: "enabled"

gcloud iam service-accounts add-iam-policy-binding  google-service-account-that-can-access-gcs-buckets  \ 
 --role roles/iam.workloadIdentityUser \ (or storage list role)
--member "serviceAccount: GOOGLE PROJECT NAME .svc.id.goog[kfserving-test/default]"

ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Role roles/storage.objectViewer is not supported for this resource.