<p>I am trying to retrieve cluster client certificate from GKE cluster to authenticate with Kubernetes Server API. I am using GKE API to retrieve cluster information but <strong>client certificate</strong> and <strong>client key</strong> is empty in the response. On further investigation, I found out that client certificate is disabled by-default in Google Kubernetes Engine in their latest version. Now, when I try to enable it from Cluster Settings, it says that</p>
<blockquote>
<p>client certificate is immutable.</p>
</blockquote>
<p>My question is that how I can enable client certificate for GKE cluster.</p>

<p>As per the <a href="https://gitlab.com/gitlab-org/gitlab-foss/-/issues/58208" rel="nofollow noreferrer">gitlab</a> Starting in 1.12, new clusters will not have a client certificate issued. You can manually enable (or disable) the issuance of the client certificate using the <code>--[no-]issue-client-certificate</code> flag. The clusters will have basic authentication and client certificate issuance disabled by default.</p>
<p>As per @Dawid you can create an cluster having Client certificate &gt; Enable using the below command and after that modification is not possible on that cluster.</p>
<pre><code>gcloud container clusters create YOUR-CLUSTER --machine-type=custom-2-12288 --issue-client-certificate --zone us-central1-a
</code></pre>
<p>As a workaround if you want to enable the client certificate on existing cluster, you can clone (DUPLICATE) the cluster using command line and --issue-client-certificate at the end of the command as follows:</p>
<pre><code>gcloud beta container --project &quot;xxxxxxxx&quot; clusters create &quot;high-mem-pool-clone-1&quot; --zone &quot;us-central1-f&quot; --username &quot;admin&quot; --cluster-version &quot;1.16.15-gke.6000&quot; --release-channel &quot;None&quot; --machine-type &quot;custom-2-12288&quot; --image-type &quot;COS&quot; --disk-type &quot;pd-standard&quot; --disk-size &quot;100&quot; --metadata disable-legacy-endpoints=true --scopes &quot;https://www.googleapis.com/auth/devstorage.read_only&quot;,&quot;https://www.googleapis.com/auth/logging.write&quot;,&quot;https://www.googleapis.com/auth/monitoring&quot;,&quot;https://www.googleapis.com/auth/servicecontrol&quot;,&quot;https://www.googleapis.com/auth/service.management.readonly&quot;,&quot;https://www.googleapis.com/auth/trace.append&quot; --num-nodes &quot;3&quot; --enable-stackdriver-kubernetes --no-enable-ip-alias --network &quot;projects/xxxxxxx/global/networks/default&quot; --subnetwork &quot;projects/xxxxxxxx/regions/us-central1/subnetworks/default&quot; --no-enable-master-authorized-networks --addons HorizontalPodAutoscaling,HttpLoadBalancing --enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 --issue-client-certificate
</code></pre>
