<p>I'm trying to deploy an application in a GKE 1.6.2 cluster running ContainerOS but the instructions on the website / k8s are not accurate anymore.</p>

<p>The error that I'm getting is:</p>

<pre><code>Error from server (Forbidden): User "circleci@gophers-slack-bot.iam.gserviceaccount.com"
cannot get deployments.extensions in the namespace "gopher-slack-bot".:
"No policy matched.\nRequired \"container.deployments.get\" permission." 
(get deployments.extensions gopher-slack-bot)
</code></pre>

<p>The repository for the application is available here <a href="https://github.com/gopheracademy/gopher" rel="nofollow noreferrer">available here</a>.</p>

<p>Thank you.</p>

<p>I had a few breaking changes in the past with using the gcloud tool to authenticate kubectl to a cluster, so I ended up figuring out how to auth kubectl to a specific namespace independent of GKE. Here's what works for me:</p>

<p>On CircleCI:</p>

<pre><code>setup_kubectl() {
echo "$KUBE_CA_PEM" | base64 --decode &gt; kube_ca.pem
kubectl config set-cluster default-cluster --server=$KUBE_URL --certificate-authority="$(pwd)/kube_ca.pem"
kubectl config set-credentials default-admin --token=$KUBE_TOKEN
kubectl config set-context default-system --cluster=default-cluster --user=default-admin --namespace default
kubectl config use-context default-system
}
</code></pre>

<p>And here's how I get each of those env vars from kubectl.</p>

<pre><code>kubectl get serviceaccounts $namespace -o json
</code></pre>

<p>The service account will contain the name of it's secret. In my case, with the default namespace, it's </p>

<pre><code>"secrets": [
    {
        "name": "default-token-655ls"
    }
] 
</code></pre>

<p>Using the name, I get the contents of the secret</p>

<pre><code>kubectl get secrets $secret_name -o json
</code></pre>

<p>The secret will contain <code>ca.crt</code> and <code>token</code> fields, which match the <code>$KUBE_CA_PEM</code> and <code>$KUBE_TOKEN</code> in the shell script above. </p>

<p>Finally, use <code>kubectl cluster-info</code> to get the <code>$KUBE_URL</code> value. </p>

<p>Once you run <code>setup_kubectl</code> on CI, your <code>kubectl</code> utility will be authenticated to the namespace you're deploying to. </p>
