<p><strong>I'm stuck at creating a <code>user</code> for my <code>serivice_account</code> which I can use in my kubeconfig</strong></p>

<p><strong>Background</strong>:
I have a cluser-A, which I have created using the <a href="https://github.com/googleapis/google-cloud-python" rel="nofollow noreferrer">google-cloud-python</a> library. I can see the cluster created in the console. Now I want to deploy some manifests to this cluster so i'm trying to use the <a href="https://github.com/kubernetes-client/python" rel="nofollow noreferrer">kubernetes-python</a> client. To create a <code>Client()</code> object, I need to have a KUBECONFIG so I can:</p>

<pre><code>client = kubernetes.client.load_kube_config(&lt;MY_KUBE_CONFIG&gt;)
</code></pre>

<p>I'm stuck at generating a <code>user</code> for this service_account in my kubeconfig. I don't know what kind of authentication certificate/key I should use for my <a href="https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#define-clusters-users-and-contexts" rel="nofollow noreferrer">user</a>.</p>

<p>Searched everywhere but still can't figure out how to use my service_account to access my GKE cluster through the kubernetes-python library.</p>

<p><strong>Additional Info</strong>:
I already have a <code>Credentials()</code> object (<a href="https://google-auth.readthedocs.io/en/latest/reference/google.auth.credentials.html#google.auth.credentials.Credentials" rel="nofollow noreferrer">source</a>) created using the <code>service_accounts.Credentails()</code> class (<a href="https://google-auth.readthedocs.io/en/latest/reference/google.oauth2.service_account.html#google.oauth2.service_account.Credentials" rel="nofollow noreferrer">source</a>). </p>

<p>A Kubernetes ServiceAccount is generally used by a service within the cluster itself, and most clients offer a version of <a href="https://github.com/kubernetes/client-go/blob/master/rest/config.go#L433-L439" rel="nofollow noreferrer"><code>rest.InClusterConfig()</code></a>. If you mean a GCP-level service account, it is activated as below:</p>

<pre><code>gcloud auth activate-service-account --key-file gcp-key.json
</code></pre>

<p>and then probably you would set a project and use <code>gcloud container clusters get-credentials</code> as per normal with GKE to get Kubernetes config and credentials.</p>
