<p>I am trying to integrate CircleCi with gcloud Kubernetes engine.</p>

<ol>
<li>I created a service account with Kubernetes Engine Developer and Storage Admin roles.</li>
<li>Created CircleCi yaml file and configured CI.</li>
</ol>

<p>Part of my yaml file includes:</p>

<pre><code>docker:
            - image: google/cloud-sdk
        environment:
            - PROJECT_NAME: 'my-project'
            - GOOGLE_PROJECT_ID: 'my-project-112233'
            - GOOGLE_COMPUTE_ZONE: 'us-central1-a'
            - GOOGLE_CLUSTER_NAME: 'my-project-bed'
        steps:
            - checkout
            - run:
                  name: Setup Google Cloud SDK
                  command: |
                      apt-get install -qq -y gettext
                      echo $GCLOUD_SERVICE_KEY &gt; ${HOME}/gcloud-service-key.json
                      gcloud auth activate-service-account --key-file=${HOME}/gcloud-service-key.json
                      gcloud --quiet config set project ${GOOGLE_PROJECT_ID}
                      gcloud --quiet config set compute/zone ${GOOGLE_COMPUTE_ZONE}
                      gcloud --quiet container clusters get-credentials ${GOOGLE_CLUSTER_NAME}
</code></pre>

<p>Everything runs perfectly except that the last command:</p>

<pre><code>gcloud --quiet container clusters get-credentials ${GOOGLE_CLUSTER_NAME}
</code></pre>

<p>It keeps failing with the error:</p>

<pre><code>ERROR: (gcloud.container.clusters.get-credentials) ResponseError: code=403, message=Required "container.clusters.get" permission(s) for "projects/my-project-112233/zones/us-central1-a/clusters/my-project-bed". See https://cloud.google.com/kubernetes-engine/docs/troubleshooting#gke_service_account_deleted for more info.
</code></pre>

<p>I tried to give the ci account the role of project owner but I still got that error.</p>

<p>I tried to disable and re-enable the Kubernetes Service but it didn't help.</p>

<p>Any idea how to solve this? I am trying to solve it for 4 days...</p>

Naor
<p>This is an old thread, this is how this issue handled today in case using <strong>cloud build</strong> :</p>
<p><strong>Granting Cloud Build access to GKE</strong></p>
<p>To deploy the application in your Kubernetes cluster, Cloud Build needs the Kubernetes Engine Developer Identity and Access Management Role.</p>
<p><strong>Get Project Number:</strong></p>
<pre class="lang-sh prettyprint-override"><code>PROJECT_NUMBER=&quot;$(gcloud projects describe ${PROJECT_ID} --format='get(projectNumber)')&quot;
</code></pre>
<p><strong>Add IAM Policy bindings:</strong></p>
<pre class="lang-sh prettyprint-override"><code>gcloud projects add-iam-policy-binding ${PROJECT_NUMBER} \
    --member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com \
    --role=roles/container.developer
</code></pre>
<p>More info can be found <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/gitops-cloud-build#granting_access_to" rel="noreferrer">here</a>.</p>
