<p>At work we use Kubernetes hosted in GCP. I also have a side project hosted in my <em>personal</em> GCP account using Google App Engine (deploy using <code>gcloud app deploy</code>).</p>

<p>Often when I try to run a command such as <code>kubectl logs -f service-name</code>, I get an error like "Error from server (Forbidden): pods is forbidden: User "my_personal_email@gmail.com" cannot list resource "pods" in API group "" in the namespace "WORK_NAMESPACE": Required "container.pods.list" permission." and then I have to fight with kubectl for hours trying to get it to work.</p>

<p>Can somebody please break it down for a slow person like me, how <code>gcloud</code> and <code>kubectl</code> work together, and how I can easily switch accounts so I can use <code>gcloud</code> commands for my personal projects and <code>kubectl</code> commands for my work projects? I'm happy to nuke my whole config and start from scratch if that's what it takes. I've found various <code>kubectl</code> and <code>gcloud</code> documentation but it doesn't make much sense or talks in circles.</p>

<p>Edit: this is on Linux. </p>

<p>Had the same problem and doing all of the:</p>
<pre><code>gcloud auth login
gcloud auth list
gcloud config set account
gcloud projects list
</code></pre>
<p>didn't help. I knew <code>gcloud</code> switched fine as I was able to list other resources with it directly.
But it seems <code>kubectl</code> can't pick those changes up automatically, as <code>kubectl/gcloud</code> integration relies on the pre-generated key, which has a 1h expiration(not sure if it's a default but it's what it is on my machine right now).
So, on top of setting right user/project/account with <code>gcloud</code>, you should re-generate the creds:</p>
<p><code>gcloud container clusters get-credentials &lt;my-cluster&gt; --zone &lt;clusters-zone&gt;</code></p>
