<p>I'm trying to setup a continuous integration job that will deploy to kubernetes / google container engine from a Jenkins job. The jenkins server is relatively tightly controlled, so I'm not able to install plugins.</p>

<p>I have a JSON key file for a server account from Google Cloud IAM.</p>

<p>I'm currently trying to download the google cloud sdk and auth from there, but am not having any luck (this if from a Jenkinsfile):</p>

<pre><code>sh 'export KUBECONFIG=$(pwd)/.kubeconfig'
sh 'export GOOGLE_APPLICATION_CREDENTIALS=$JSON'
sh 'google-cloud-sdk/bin/gcloud auth activate-service-account --key-file=$JSON'
sh 'google-cloud-sdk/bin/gcloud config set core/project proj-1'
sh 'google-cloud-sdk/bin/gcloud container clusters list'
sh 'google-cloud-sdk/bin/gcloud container clusters get-credentials clust-1 --zone us-east1-c'
sh 'kubectl get pods'
</code></pre>

<p>I'm getting the error message:
error: google: could not find default credentials. See <a href="https://developers.google.com/accounts/docs/application-default-credentials" rel="nofollow noreferrer">https://developers.google.com/accounts/docs/application-default-credentials</a> for more information.
I will also need to be able to do a gcloud docker push, so using gcloud is ok.</p>

<p>There's a cryptic github issue around this behavior:</p>
<p><a href="https://github.com/kubernetes/kubernetes/issues/30617" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/30617</a></p>
<p>According to that issue, everything I've been doing should work:</p>
<blockquote>
<p>Previously, gcloud would have configured kubectl to use the cluster's static client certificate to authenticate. Now, gcloud is configuring kubectl to use the service account's credentials.</p>
<p>Kubectl is just using the Application Default Credentials library, and it looks like this is part of the ADC flow for using a JSON-key service account. I'll see if there is a way that we could make this nicer.</p>
<p>If you don't want to add the export GOOGLE_APPLICATION_CREDENTIALS=&quot;/path/to/keyfile.json&quot; to your flow, you can reenable the old way (use the client cert) by setting the cloudsdk container/use_client_certificate property to true. Either:</p>
<p>gcloud config set container/use_client_certificate True</p>
<p>or</p>
<p>export CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True</p>
</blockquote>
<p>I was using the GOOGLE_APPLICATION_CREDENTIALS variable, but alas, was not working. I tried the &quot;gcloud config set&quot; option up above, but that also didn't work. Finally, I used the env variable CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFCIATE and that actually finally did work.</p>
