<p>As part of a Jenkins pipeline to build and deploy an app to Google's Kubernetes service (GKE), I've created a script to carry out the following deployment to GKE:</p>

<ul>
<li>checkout code </li>
<li>setup authentication to gcloud and </li>
<li>create the deployment and service using kubectl:</li>
</ul>

<p>Detailed steps implemented by the script are as follows:</p>

<pre><code>a) Create the docker registry authentication file (.json)
b) login to the google docker registry using the authentication file
c) initialise a git repo in the current directory
d) add the remote origin in prep for code pull
e) pull the source code for the microservice container
f) Create a kubectl configurtion file and directory to authenticate to the kubernetes cluster in Gcloud
g) Create a keyfile for a Gcloud service account that needs to authenticate to the container service
h) Activate the service account
i) Get the credentials for the container cluster from Gcloud
j) Run kubectl apply to create the kubernetes services
</code></pre>

<p>Full, tested, script at: <a href="https://pastebin.com/sZPrQuzD" rel="nofollow noreferrer">https://pastebin.com/sZPrQuzD</a></p>

<p>If I put this sequence of steps in a scripts on an AWS EC2 instance and run it manually it works. However,the Jenkins build step fails at the the point kubectl is invoked to run the service, with the following error:</p>

<pre><code>gcloud container clusters get-credentials jenkins-cd --zone europe-west1-b --project noon-prod
Fetching cluster endpoint and auth data.
ERROR: (gcloud.container.clusters.get-credentials) ResponseError:   code=403, message=Request had insufficient authentication scopes.
Build step 'Execute shell' marked build as failure
</code></pre>

<p>The full error  dump from the Jenkins run is as follows:</p>

<p><a href="https://pastebin.com/pSWPQ5Ei" rel="nofollow noreferrer">https://pastebin.com/pSWPQ5Ei</a></p>

<p>My questions:</p>

<p>a) How to fix this? Surely it can't be that difficult to get authentication running from Jenkins?</p>

<p>b) Is this the correct way to authenticate to the gcloud container service from a Jenkins system which is not on Gcloud infrastructure at all?</p>

<p>Many thanks in advance for any help!
Traiano</p>

<p>We're working on an open source project called <a href="https://jenkins-x.io/" rel="nofollow noreferrer">Jenkins X</a> which is a proposed sub project of the Jenkins foundation aimed at automating CI/CD on Kubernetes using Jenkins and GitOps for promotion.</p>

<p>We worked around some of the issues you've been having by running the Jenkins pipelines inside the kubernetes cluster; so there's no need to authenticate with GKE.</p>

<p>When you merge a change to the master branch, Jenkins X creates a new semantically versioned distribution of your app (pom.xml, jar, docker image, helm chart). The pipeline then automates the generation of Pull Requests to promote your application through all of the Environments via GitOps.</p>

<p>Here's <a href="https://jenkins-x.io/demos/devoxx-uk-2018/" rel="nofollow noreferrer">a demo of how to automate CI/CD with multiple environments on Kubernetes using GitOps</a> for promotion between environments and Preview Environments on Pull Requests - using Spring Boot and nodejs apps (but we support many languages + frameworks).</p>
