<p>I am struggling to programmatically access a kubernetes cluster running on Google Cloud. I have set up a service account and pointed <code>GOOGLE_APPLICATION_CREDENTIALS</code> to a corresponding credentials file. I managed to get the cluster and credentials as follows:</p>

<pre class="lang-py prettyprint-override"><code>import google.auth
from google.cloud.container_v1 import ClusterManagerClient
from kubernetes import client

credentials, project = google.auth.default(
    scopes=['https://www.googleapis.com/auth/cloud-platform',])

credentials.refresh(google.auth.transport.requests.Request())

cluster_manager = ClusterManagerClient(credentials=credentials)
cluster = cluster_manager.get_cluster(project, 'us-west1-b', 'clic-cluster')
</code></pre>

<p>So far so good. But then I want to start using the kubernetes client:</p>

<pre class="lang-py prettyprint-override"><code>config = client.Configuration()
config.host = f'https://{cluster.endpoint}:443'
config.verify_ssl = False
config.api_key = {"authorization": "Bearer " + credentials.token}
config.username = credentials._service_account_email

client.Configuration.set_default(config)

kub = client.CoreV1Api()
print(kub.list_pod_for_all_namespaces(watch=False))
</code></pre>

<p>And I get an error message like this:</p>

<p><em><strong>pods is forbidden: User "12341234123451234567" cannot list resource "pods" in API group "" at the cluster scope: Required "container.pods.list" permission.</strong></em></p>

<p>I found <a href="https://cloud.google.com/kubernetes-engine/docs/reference/api-permissions" rel="nofollow noreferrer">this website</a> describing the <code>container.pods.list</code>, but I don't know where I should add it, or how it relates to the API scopes <a href="https://developers.google.com/identity/protocols/googlescopes" rel="nofollow noreferrer">described here</a>.</p>

<p>As per the error:</p>

<blockquote>
  <p>pods is forbidden: User "12341234123451234567" cannot list resource
  "pods" in API group "" at the cluster scope: Required
  "container.pods.list" permission.</p>
</blockquote>

<p>it seems evident the user credentials you are trying to use, does not have permission on listing the pods.</p>

<p>The entire list of permissions mentioned in <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/iam" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/iam</a>, states the following:</p>

<p>There are different Role which can play into account here:</p>

<ul>
<li>If you are able to get cluster, then it is covered with multiple <strong>Role</strong> sections like:  <code>Kubernetes Engine Cluster Admin</code>, <code>Kubernetes Engine Cluster Viewer</code>, <code>Kubernetes Engine Developer</code> &amp; <code>Kubernetes Engine Viewer</code></li>
<li>Whereas, if you want to list pods <code>kub.list_pod_for_all_namespaces(watch=False)</code> then you might need <code>Kubernetes Engine Viewer</code> access.</li>
</ul>

<p><a href="https://i.stack.imgur.com/wj3jS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wj3jS.png" alt="enter image description here"></a></p>

<p>You should be able to add multiple roles.</p>
