<p>Does anyone know how to connect a local instance of <code>kubectl</code> to a Google Kubernetes Engine (GKE) cluster, without using the <code>gcloud</code> tool locally?</p>

<p><strong>For example:</strong></p>

<p>If you use the <code>gcloud</code> tool with this command:</p>

<pre><code>gcloud container clusters get-credentials NAME [--zone=ZONE, -z ZONE] [GCLOUD_WIDE_FLAG …]
</code></pre>

<p>You'll find a user like this in <code>~/.kube/config</code>:</p>

<pre><code>- name: gke_myproj_myzone
  user:
    auth-provider:
      config:
        access-token: TOKENSTRING
        cmd-args: config config-helper --format=json
        cmd-path: /google/google-cloud-sdk/bin/gcloud
        expiry: 2018-01-22 18:05:46
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp
</code></pre>

<p>As you can see, the default values, the <code>gcloud</code> tool provides require the <code>glcoud</code> tool as an <em>auth-provider</em> to log in to your cluster.</p>

<p>Now, what I'm looking for is a way to connect <code>kubectl</code> to a cluster on a machine, that does not have <code>gcloud</code> installed.</p>

<p>The easiest way to achieve this is by copying the <code>~/.kube/config</code> file (from a gcloud authenticated instance) to this directory <code>$HOME/.kube</code> in your local instance (laptop). </p>

<p>But first, and using the authenticated instance, you would have to enable legacy cluster per this <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/iam-integration#using_legacy_cluster_certificate_or_user_credentials" rel="noreferrer">document</a> by running these commands:</p>

<pre><code>gcloud config set container/use_client_certificate True
export CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True
</code></pre>

<p>Then execute the <code>get-credentials</code> command, and copy the file. </p>

<pre><code>gcloud container clusters get-credentials NAME [--zone=ZONE, -z ZONE] [GCLOUD_WIDE_FLAG …]
</code></pre>

<p>Note that you may have to run the <code>get-credentials</code> command, and copy the config file every time authentication tokens (saved in the config file) expire. </p>
