<p>I had a GKE cluster my-cluster created in a project that belonged to organization org1.</p>
<p>When the cluster was created I logged in with user@org1.com using <code>gcloud auth login</code> and configured the local kubeconfig using <code>gcloud container clusters get-credentials my-cluster --region europe-west4 --project project</code>.</p>
<p>Recently we had to migrate this project (with the GKE cluster) to another organization, org2. We did it sucessfully <a href="https://cloud.google.com/resource-manager/docs/project-migration" rel="nofollow noreferrer">following the documentation</a>.</p>
<p>The IAM owner in org2 is user@org2.com. In order to reconfigure the kube config I followed the previous steps, logging in in this case with user@org2.com:</p>
<p><code>gcloud auth login</code></p>
<p><code>gcloud container clusters get-credentials my-cluster --region europe-west4 --project project</code>.</p>
<p>When I execute <code>kubectl get pods</code> I get an error referencing the old org1 user:</p>
<pre><code>Error from server (Forbidden): pods is forbidden: User &quot;user@org1.com&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;: requires one of [&quot;container.pods.list&quot;] permission(s).
</code></pre>
<p>What's the problem here?</p>

codependent
<p>I've accepted DazWilking's answer since in a way he was right, the config file was &quot;inconsistent&quot;.</p>
<p>The problematic bit was in the user section:</p>
<pre><code>  user:
    auth-provider:
      config:
        access-token: xxxxxx      
        expiry: &quot;2021-07-11T18:36:42Z&quot;
</code></pre>
<p>For some reason when using the <code>gcloud container clusters get-credential</code> command it created all items (cluster, context and user)  with an invalid user section.</p>
<p>To fix it I connected to a cloud shell directly from the Google Cloud web console and checked the <code>./kube/config</code> file there. My local config was missing the cmd-path, cmd-args, expiry-key and token-key entries:</p>
<pre><code>  user:
    auth-provider:
      config:
        access-token: xxx
        cmd-args: config config-helper --format=json
        cmd-path: /Users/xxx/applications/google-cloud-sdk/bin/gcloud
        expiry: &quot;2021-07-11T18:36:42Z&quot;
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
</code></pre>
