<p>Need to deploy cluster to GCP and setup, helm, ingress and some other stuff without manually running gcloud command.
Tried many ways google_container_cluster with and without certs and user/pass.
I get two kind of results:</p>

<p><code>Error: serviceaccounts is forbidden: User "system:anonymous" cannot create resource "serviceaccounts" in API group "" in the namespace "kube-system"</code>
or
<code>Error: serviceaccounts is forbidden: User "client" cannot create resource "serviceaccounts" in API group "" in the namespace "kube-system"</code>.</p>

<p>What I managed to understand is if I generate certs gke will have default user "client" corresponding to cert it will create otherwise it will keep default user "anonymous" - no user.</p>

<p>My issue is I cannot find way to tell <code>google_container_cluster</code> to use specific account nor tell <code>provider "kubernetes"</code> to take any user.
Also cannot find a way to apply RBAC file to cluster without authenticating via <code>gcloud</code>.</p>

<p>I solved this issue by updating how Terraform connect to the Kubernetes cluster. As I change the backend to use "remote" (Terraform Cloud) it does not work anymore and I have the same kind of error message.
It is because with "remote" backend Terraform doesn't use the local kubectl config.</p>

<p>see for example : <a href="https://github.com/terraform-providers/terraform-provider-kubernetes/issues/347" rel="nofollow noreferrer">https://github.com/terraform-providers/terraform-provider-kubernetes/issues/347</a></p>

<p>So I add a block to get the config</p>

<pre><code>data "google_client_config" "default" {
}
</code></pre>

<p>Then I update from using "client_certificate" and "client_key" to "token":</p>

<pre><code>provider "kubernetes" {
  load_config_file       = false
  host                   = data.google_container_cluster.gke-cluster.endpoint
  token                  = data.google_client_config.default.access_token
  cluster_ca_certificate = base64decode(data.google_container_cluster.gke-cluster.master_auth.0.cluster_ca_certificate)
}
</code></pre>

<p>Hope this can be useful for someone else.</p>
