{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30617","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30617/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30617/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30617/events","html_url":"https://github.com/kubernetes/kubernetes/issues/30617","id":171154072,"number":30617,"title":"gcloud container get-credentials not authenticating service account","user":{"login":"Draiken","id":287889,"avatar_url":"https://avatars.githubusercontent.com/u/287889?v=3","gravatar_id":"","url":"https://api.github.com/users/Draiken","html_url":"https://github.com/Draiken","followers_url":"https://api.github.com/users/Draiken/followers","following_url":"https://api.github.com/users/Draiken/following{/other_user}","gists_url":"https://api.github.com/users/Draiken/gists{/gist_id}","starred_url":"https://api.github.com/users/Draiken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Draiken/subscriptions","organizations_url":"https://api.github.com/users/Draiken/orgs","repos_url":"https://api.github.com/users/Draiken/repos","events_url":"https://api.github.com/users/Draiken/events{/privacy}","received_events_url":"https://api.github.com/users/Draiken/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/ux","name":"team/ux","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"cjcullen","id":7154008,"avatar_url":"https://avatars.githubusercontent.com/u/7154008?v=3","gravatar_id":"","url":"https://api.github.com/users/cjcullen","html_url":"https://github.com/cjcullen","followers_url":"https://api.github.com/users/cjcullen/followers","following_url":"https://api.github.com/users/cjcullen/following{/other_user}","gists_url":"https://api.github.com/users/cjcullen/gists{/gist_id}","starred_url":"https://api.github.com/users/cjcullen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjcullen/subscriptions","organizations_url":"https://api.github.com/users/cjcullen/orgs","repos_url":"https://api.github.com/users/cjcullen/repos","events_url":"https://api.github.com/users/cjcullen/events{/privacy}","received_events_url":"https://api.github.com/users/cjcullen/received_events","type":"User","site_admin":false},"assignees":[{"login":"cjcullen","id":7154008,"avatar_url":"https://avatars.githubusercontent.com/u/7154008?v=3","gravatar_id":"","url":"https://api.github.com/users/cjcullen","html_url":"https://github.com/cjcullen","followers_url":"https://api.github.com/users/cjcullen/followers","following_url":"https://api.github.com/users/cjcullen/following{/other_user}","gists_url":"https://api.github.com/users/cjcullen/gists{/gist_id}","starred_url":"https://api.github.com/users/cjcullen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjcullen/subscriptions","organizations_url":"https://api.github.com/users/cjcullen/orgs","repos_url":"https://api.github.com/users/cjcullen/repos","events_url":"https://api.github.com/users/cjcullen/events{/privacy}","received_events_url":"https://api.github.com/users/cjcullen/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2016-08-15T11:33:58Z","updated_at":"2016-08-18T00:30:41Z","closed_at":null,"body":"**Kubernetes version**: `Client Version: version.Info{Major:\"1\", Minor:\"3\", GitVersion:\"v1.3.3\", GitCommit:\"c6411395e09da356c608896d3d9725acab821418\", GitTreeState:\"clean\", BuildDate:\"2016-07-22T20:29:38Z\", GoVersion:\"go1.6.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}`\r\n\r\n\r\n**Environment**:\r\n- **Cloud provider or hardware configuration**: GKE\r\n- **OS** (e.g. from /etc/os-release): Debian 8\r\n- **Kernel** (e.g. `uname -a`): Linux 5ab86176e0e5 3.13.0-88-generic #135-Ubuntu SMP Wed Jun 8 21:10:42 UTC 2016 x86_64 GNU/Linux\r\n\r\n**What happened**: After successfully authenticating with a service account on `gcloud` using: \r\n```\r\ngcloud auth activate-service-account $GOOGLE_AUTH_EMAIL --key-file /keyconfig.json --project $GOOGLE_PROJECT_ID\r\n```\r\nThe cluster credentials were downloaded using:\r\n```\r\ngcloud container clusters get-credentials $CLUSTER_NAME\r\n```\r\nEven tho no errors are raised, when attempting to run `kubectl version` I get this error:\r\n```\r\nkubectl version\r\nClient Version: version.Info{Major:\"1\", Minor:\"3\", GitVersion:\"v1.3.3\", GitCommit:\"c6411395e09da356c608896d3d9725acab821418\", GitTreeState:\"clean\", BuildDate:\"2016-07-22T20:29:38Z\", GoVersion:\"go1.6.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nerror: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.\r\n```\r\n\r\n**What you expected to happen**: Kubectl should be configured to use the cluster properly\r\n\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n* Authenticate with a service account on gcloud\r\n* Get credentials from a cluster through gcloud\r\n* Run any kubectl command that reaches the server\r\n\r\n\r\n**Anything else do we need to know**:\r\nAfter looking into the configuration environment I observed the user is not properly configured on `.kube/config`:\r\n```\r\nkubectl config view\r\napiVersion: v1\r\nclusters:\r\n- cluster:\r\n    certificate-authority-data: REDACTED\r\n    server: REDACTED\r\n  name: gke_cluster_name\r\ncontexts:\r\n- context:\r\n    cluster:  gke_cluster_name\r\n    user: gke_cluster_name\r\n  name:  gke_cluster_name\r\ncurrent-context:  gke_cluster_namel\r\nkind: Config\r\npreferences: {}\r\nusers:\r\n- name:  gke_cluster_name\r\n  user:\r\n    auth-provider:\r\n      config: null\r\n      name: gcp\r\n```\r\nAfter looking in the gcloud docs, I found this instruction: \r\n```\r\nexport GOOGLE_APPLICATION_CREDENTIALS=\"/path/to/keyfile.json\"\r\n```\r\nAfter exporting the variable and running `get-credentials` once again, running `kubectl version` worked, and then running `kubectl config view` correctly displayed the user as authenticated\r\n```\r\n...\r\nusers:\r\n- name: gke_cluster_name\r\n  user:\r\n    auth-provider:\r\n      config:\r\n        access-token: REDACTED\r\n        expiry: 2016-08-15T12:30:18.220399721Z\r\n      name: gcp\r\n```\r\n\r\nNote that this workflow was running perfectly in the past. My guess is that kubectl is no longer correctly detecting the gcloud service account that is authenticated. It's only looking for the environment variable. Either way, something seems broken :)"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/240590419","html_url":"https://github.com/kubernetes/kubernetes/issues/30617#issuecomment-240590419","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30617","id":240590419,"user":{"login":"Cloven","id":495279,"avatar_url":"https://avatars.githubusercontent.com/u/495279?v=3","gravatar_id":"","url":"https://api.github.com/users/Cloven","html_url":"https://github.com/Cloven","followers_url":"https://api.github.com/users/Cloven/followers","following_url":"https://api.github.com/users/Cloven/following{/other_user}","gists_url":"https://api.github.com/users/Cloven/gists{/gist_id}","starred_url":"https://api.github.com/users/Cloven/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cloven/subscriptions","organizations_url":"https://api.github.com/users/Cloven/orgs","repos_url":"https://api.github.com/users/Cloven/repos","events_url":"https://api.github.com/users/Cloven/events{/privacy}","received_events_url":"https://api.github.com/users/Cloven/received_events","type":"User","site_admin":false},"created_at":"2016-08-18T00:30:41Z","updated_at":"2016-08-18T00:30:41Z","body":"Some questions:\r\n\r\n1.  What are the full recommended steps for configuring e.g., a third-party CI server to have minimal permissions to be able to schedule instances into a GKE cluster?  \r\n\r\n2.  Where are the specific permissions granted by a container engine service account role documented (i.e. what is 'Container Engine Developer' vs. 'Container Engine Admin')?\r\n"}}
{"actor":{"display_login":"Cloven"}}