<p>I have got a Google Cloud IAM service account key file (in json format) that contains below data.</p>

<pre><code>{
"type": "service_account",
"project_id": "****",
"private_key_id":"****",
"private_key": "-----BEGIN PRIVATE KEY----blah blah -----END PRIVATE KEY-----\n",
"client_email": "*****",
"client_id": "****",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth/v1/certs",
"client_x509_cert_url": "****"
}
</code></pre>

<p>I can use this service account to access kubernetes API server by passing this key file to kube API client libraries. </p>

<p>But, I'm not finding any way to pass this service account to kubectl binary to have kubectl get authenticated to project for which this service account created for.</p>

<p>Is there any way that I can use to make Kubectl to use this service account file for authentication ?</p>

<p>This answer provides some guidance: <a href="https://stackoverflow.com/questions/48400966/access-kubernetes-gke-cluster-outside-of-gke-cluster-with-client-go/48412272#48412272">Access Kubernetes GKE cluster outside of GKE cluster with client-go?</a>  but it's not complete.</p>

<p>You need to do two things:</p>

<ol>
<li><p>set <code>GOOGLE_APPLICATION_CREDENTIALS</code> environment variable to path to your JSON key file for the IAM service account, and use <code>kubectl</code> while this variable is set, you should be authenticated with the token.</p></li>
<li><p>(this may be optional, not sure) Create a custom <code>KUBECONFIG</code> that only contains your cluster IP and CA certificate, save this file, and use it to connect to the cluster.</p></li>
</ol>

<p>Step 2 looks like this:</p>

<pre><code>cat &gt; kubeconfig.yaml &lt;&lt;EOF
apiVersion: v1
kind: Config
current-context: cluster-1
contexts: [{name: cluster-1, context: {cluster: cluster-1, user: user-1}}]
users: [{name: user-1, user: {auth-provider: {name: gcp}}}]
clusters:
- name: cluster-1
  cluster:
    server: "https://$(eval "$GET_CMD --format='value(endpoint)'")"
    certificate-authority-data: "$(eval "$GET_CMD --format='value(masterAuth.clusterCaCertificate)'")"
EOF
</code></pre>

<p>So with this, you should do</p>

<pre><code>export GOOGLE_APPLICATION_CREDENTIALS=&lt;path-to-key.json&gt;
export KUBECONFIG=kubeconfig.yaml
kubectl get nodes
</code></pre>
