<p>I have a Kubernetes cluster. Inside my cluster is a Django application which needs to connect to my Kubernetes cluster on GKE. Upon my Django start up (inside my Dockerfile), I authenticate with Google Cloud by using:</p>
<pre><code>gcloud auth activate-service-account $GKE_SERVICE_ACCOUNT_NAME --key-file=$GOOGLE_APPLICATION_CREDENTIALS
gcloud config set project $GKE_PROJECT_NAME
gcloud container clusters get-credentials $GKE_CLUSTER_NAME --zone $GKE_ZONE
</code></pre>
<p>I am not really sure if I need to do this everytime my Django container starts, and I am not sure I understand how authentication to Google Cloud works. Could I perhaps just generate my Kubeconfig file, store it somewhere safe and use it all the time instead of authenticating?
In other words, is a Kubeconfig file enough to connect to my GKE cluster?</p>

s3nti3ntB
<p>If your service is running in a Pod inside the GKE cluster you want to connect to, use a Kubernetes service account to authenticate.</p>
<ol>
<li><p>Create a Kubernetes service account and attach it to your Pod. If your Pod already has a Kubernetes service account, you may skip this step.</p>
</li>
<li><p>Use Kubernetes RBAC to grant the Kubernetes service account the correct permissions.</p>
</li>
</ol>
<p>The following example grants <strong>edit</strong> permissions in the <strong>prod</strong> namespace:</p>
<pre><code>kubectl create rolebinding yourserviceaccount \
    --clusterrole=edit \
    --serviceaccount=yournamespace:yourserviceaccount\
    --namespace=prod
</code></pre>
<ol start="3">
<li>At runtime, when your service invokes <code>kubectl</code>, it automatically receives the credentials you configured.</li>
</ol>
<p>You can also store the credentials as a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">secret</a> and mount it on your pod so that it can read them from there</p>
<p>To use a Secret with your workloads, you can specify environment variables that reference the Secret's values, or mount a volume containing the Secret.</p>
<p>You can create a Secret using the command-line or a YAML file.</p>
<p>Here is an example using Command-line</p>
<pre><code>kubectl create secret SECRET_TYPE SECRET_NAME DATA
</code></pre>
<p><code>SECRET_TYPE:</code> the Secret type, which can be one of the following:</p>
<ul>
<li><code>generic:</code>Create a Secret from a local file, directory, or literal value.</li>
<li><code>docker-registry:</code>Create a <code>dockercfg</code> Secret for use with a Docker registry. Used to authenticate against Docker registries.</li>
<li><code>tls:</code>Create a TLS secret from the given public/private key pair. The public/private key pair must already exist. The public key certificate must be .PEM encoded and match the given private key.</li>
</ul>
<p>For most Secrets, you use the <code>generic</code> type.</p>
<p><code>SECRET_NAME:</code> the name of the Secret you are creating.</p>
<p><code>DATA:</code> the data to add to the Secret, which can be one of the following:</p>
<ul>
<li>A path to a directory containing one or more configuration files, indicated using the <code>--from-file</code> or <code>--from-env-file</code> flags.</li>
<li>Key-value pairs, each specified using <code>--from-literal</code> flags.</li>
</ul>
<p>If you need more information about <code>kubectl create</code> you can check the <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#create" rel="nofollow noreferrer">reference documentation</a></p>
