With this change, you can add --google_json_key=/path/to/key.json to the DAEMON_ARGS of the kubelet, e.g.
   nano /etc/default/kubelet
   ... # Add the flag
   service kubelet restart

With this setting, minions will be able to authenticate with gcr.io repositories nearly as smoothly as if K8s were running on GCE.

NOTE: This private key can be used to access most project resources, consider dropping the service account created through this flow to a project READER, or restricting its access to just the GCS bucket containing the container images.