<ul>
<li>I have multiple kubernetes clusters running on GKE (let's say clusterA and clusterB)</li>
<li>I want to access both of those clusters from client-go in an app that is running in one of those clusters (e.g. access clusterB from an app that is running on clusterA)</li>
</ul>

<p>I general for authenticating with kubernetes clusters from client-go I see that I have two options:</p>

<ul>
<li>InCluster config</li>
<li>or from kube config file</li>
</ul>

<p>So it is easy to access clusterA from clusterA but not clusterB from clusterA.</p>

<p>What are my options here? It seems that I just cannot pass <code>GOOGLE_APPLICATION_CREDENTIALS</code> and hope that client-go will take care of itself.</p>

<p>So my thinking:</p>

<ul>
<li>create a dedicated IAM service account</li>
<li>create kube config with tokens for both clusters by doing <code>gcloud container clusters get-credentials clusterA</code> and <code>gcloud container clusters get-credentials clusterB</code></li>
<li>use that kube config file in client-go via <code>BuildConfigFromFlags</code> on clusterA</li>
</ul>

<p>Is this the correct approach, or is there a simpler way? I see that tokens have an expiration date?</p>

<p><strong>Update:</strong></p>

<p>It seems I can also use <code>CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud beta container clusters get-credentials clusterB --zone</code>. Which would add certificates to kube conf which I could use. But AFAIK those certificates cannot be revoked</p>

<p>client-go needs to know about:</p>

<ol>
<li>cluster master’s IP address</li>
<li>cluster’s CA certificate</li>
</ol>

<p>(If you're using GKE, you can see these info in <code>$HOME/.kube/config</code>, populated by <code>gcloud container clusters get-credentials</code> command).</p>

<p>I recommend you to either:</p>

<ol>
<li>Have a kubeconfig file that contains these info for clusters A &amp; B</li>
<li>Use GKE API to retrieve these info for clusters A &amp; B (<a href="https://ahmet.im/blog/gke-api/" rel="noreferrer">example here</a>) (You'll need a service account to do this, explained below.)</li>
</ol>

<p>Once you can create a <code>*rest.Config</code> object in client-go, client-go will use the auth plugin that's specified in the kubeconfig file (or its in-memory equivalent you constructed).  In <code>gcp</code> auth plugin, it knows how to retrieve a token.</p>

<p>Then, <a href="https://cloud.google.com/iam/docs/creating-managing-service-accounts" rel="noreferrer">Create a Cloud IAM Service Account</a> and give it "Container Developer" role. Download its key.</p>

<p>Now, you have two options:</p>

<h3>Option 1: your program uses gcloud</h3>

<pre><code>gcloud auth activate-service-account --key-file=key.json
KUBECONFIG=a.yaml gcloud container clusters get-credentials clusterA
KUBECONFIG=b.yaml gcloud container clusters get-credentials clusterB
</code></pre>

<p>Then create 2 different <code>*rest.Client</code> objects, one created from <code>a.yaml</code>, another from <code>b.yaml</code> in your program.</p>

<p>Now your program will rely on <code>gcloud</code> binary to retrieve token every time your token expires (every 1 hour).</p>

<h3>Option 2: use GOOGLE_APPLICATION_CREDENTIALS</h3>

<ol>
<li>Don't install gcloud to your program’s environment.</li>
<li>Set your key.json to GOOGLE_APPLICATION_CREDENTIALS environment 
variable for your program.</li>
<li>Figure out a way to get cluster IP/CA (explained above) so you can
construct two different <code>*rest.Config</code> objects for cluster A &amp; B.</li>
<li>Now your program will use the specified key file to get an access_token
to Google API every time it expires (every 1h).</li>
</ol>

<p>Hope this helps.</p>

<p>P.S. do not forget to <code>import _ "k8s.io/client-go/plugin/pkg/client/auth/gcp"</code> in your Go program. This loads the gcp auth plugin!</p>
