<p>I am trying to access my Kubernetes cluster on google cloud with the service account, but I am not able to make this works.  I have a running system with some pods and ingress. I want to be able to update images of deployments. </p>

<p>I would like to use something like this (remotely): </p>

<pre><code>kubectl config set-cluster cluster --server="&lt;IP&gt;" --insecure-skip-tls-verify=true
kubectl config set-credentials foo --token="&lt;TOKEN&gt;"
kubectl config set-context my-context --cluster=cluster --user=foo --namespace=default
kubectl config use-context cluster
kubectl set image deployment/my-deployment boo=eu.gcr.io/project-123456/image:v1
</code></pre>

<p>So I created the service account and then get the secret token:</p>

<pre><code>kubectl create serviceaccount foo
kubectl get secret foo-token-gqvgn -o yaml
</code></pre>

<p>But, when I try to update the image in any deployment, I receive: </p>

<blockquote>
  <p>error: You must be logged in to the server (Unauthorized)</p>
</blockquote>

<p>IP address for API I use the address, which is shown in GKE administration as cluster endpoint IP.
Any suggestions? Thanks. </p>

<p>I have tried to recreate your problem.</p>
<p>Steps I have followed</p>
<ul>
<li><code>kubectl create serviceaccount foo</code></li>
<li><code>kubectl get secret foo-token-* -o yaml</code></li>
</ul>
<p>Then, I have tried to do what you have done</p>
<p><strong>What I have used</strong> as token is <code>base64</code> decoded Token.</p>
<p>Then I tried this:</p>
<pre><code>$ kubectl get pods
</code></pre>
<blockquote>
<p>Error from server (Forbidden): pods is forbidden: User &quot;system:serviceaccount:default:foo&quot; cannot list pods in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:default:foo&quot;</p>
</blockquote>
<p>This gave me error as expected. Because, I need to grant permission to this ServiceAccount.</p>
<p><strong>How can I grant permission</strong> to this ServiceAccount? I need to create ClusterRole &amp; ClusterRoleBinding with necessary permission.</p>
<p>Read more to learn more <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control" rel="nofollow noreferrer">role-based-access-control</a></p>
<h2>I can do another thing</h2>
<pre><code>$ kubectl config set-credentials foo --username=&quot;admin&quot; --password=&quot;$PASSWORD&quot;
</code></pre>
<p>This will grant you admin authorization.</p>
<p>You need to provide cluster credential.</p>
<pre><code>Username: admin
Password: -----
</code></pre>
<p>You will get this info in GKE -&gt; Kubernetes Engine -&gt; {cluster} -&gt; Show credential</p>
