<p>I've been working on a python project with the goal to interact with Kubernetes. One of the problems I have run into is the authentication process. Similar to <a href="https://stackoverflow.com/questions/50717812/google-cloud-natural-language-api-errorgoogle-auth-exceptions-defaultcredential">this</a> question I get the error</p>

<blockquote>
  <p>google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see <a href="https://cloud.google.com/docs/authentication/getting-started" rel="nofollow noreferrer">https://cloud.google.com/docs/authentication/getting-started</a></p>
</blockquote>

<p>I understand that this is probably due to the fact that I use pycharm. However, when I run it from the terminal, I get this error:</p>

<blockquote>
  <p>kubernetes.client.rest.ApiException: (403)
  Reason: Forbidden
  HTTP response headers: HTTPHeaderDict({'Audit-Id': 'XXXXXXXXXXX', 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'XXXXXXXXXXXXXXXX', 'Content-Length': 'XXX'})
  HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"deployments.extensions is forbidden: User \"XXXXXXXXXXXXXXXXXXX\" cannot create deployments.extensions in the namespace \"default\": Required \"container.deployments.create\" permission.","reason":"Forbidden","details":{"group":"extensions","kind":"deployments"},"code":403}</p>
</blockquote>

<p>However, when I change my code from:</p>

<pre><code>os.system(f"gcloud container clusters get-credentials {cluster_name} --zone {zone} --project {project}")
</code></pre>

<p>to</p>

<pre><code>os.system(f"gcloud container clusters get-credentials {cluster_name} --zone {zone} --project {project}")
os.system("kubectl run hello-server --image gcr.io/google-samples/hello-app:1.0 --port 8080")
os.system("kubectl delete deployments hello-server")
</code></pre>

<p>I can authenticate and all other functionality is exactly as it should be. I don't understand why this is. I think it's probably an indication something is wrong and would like to fix it before continuing. Does anybody know what is happening here, and how to fix it?</p>

Nathan
<p>From your error description I can see, that You are <strong>not</strong> having problem with authentication but authorization to Kubernetes. These are two different things.</p>

<p>The error message you posted should be interpreted in following way: <br>
"<em>You are not authorized to perform "create" action on "deployment" object.</em>" </p>

<p>The mechanism that blocks your user access to specific operation on cluster resources is called RBAC - role-based access control (RBAC), which is built in GKE, and generally enabled in Kubernetes 1.6 onwards.</p>

<p>How to solve your problem:</p>

<ol>
<li>Grant your GCP user/GCP service account appropriate role.</li>
</ol>

<p>The queasiest way is to use one of predefined <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/iam" rel="nofollow noreferrer">Cloud AIM roles for Kubernetes clusters</a>, e.g.  "roles/
container.admin", which will be mapped automatically to ClusterRole (cluster-admin). Please keep in mind to apply "principle of least privilege", especially for production clusters.</p>

<ol start="2">
<li><p>If you created a GCP Service Account in step #1</p>

<ul>
<li><p>download its key in JSON format</p></li>
<li><p>Provide authentication credentials to your application code by setting the environment variable GOOGLE_APPLICATION_CREDENTIALS <br><br></p></li>
</ul>

<p>I'm setting it up directly inside my python app:</p></li>
</ol>

<blockquote>
  <p>import os<br>
  os.environ["GOOGLE_APPLICATION_CREDENTIALS"]='gke-admin-svc-key.json'</p>
</blockquote>

<p>From now on you should be able to interact with your cluster from outside, in context of GCP service account, which should be reflected in audit logs:</p>

<pre><code>authenticationInfo: {
   principalEmail:  "&lt;id_of_your_svc_account&gt;"    
  }
  authorizationInfo: [
   0: {
    granted:  true     
    permission:  "io.k8s.core.v1.pods.list"     
    resource:  "core/v1/pods"     
   }
  ]
</code></pre>
