<p>I want to start Kubernetes jobs on a GKE cluster from a Google Cloud Function (Firebase)</p>
<p>I'm using the Kubernetes node client <a href="https://github.com/kubernetes-client/javascript" rel="nofollow noreferrer">https://github.com/kubernetes-client/javascript</a></p>
<p>I've created a Kubernetes config file using `kubectl config view --flatten -o json'</p>
<p>and loaded it</p>
<pre><code>const k8s = require('@kubernetes/client-node');
const kc = new k8s.KubeConfig();
kc.loadFromString(config)
</code></pre>
<p>This works perfectly locally but the problem is when running on cloud functions the token can't be refreshed so calls fail after a while.</p>
<p>My config k8s config files contains</p>
<pre><code>          &quot;user&quot;: {
              &quot;auth-provider&quot;: {
                  &quot;name&quot;: &quot;gcp&quot;,
                  &quot;config&quot;: {
                      &quot;access-token&quot;: &quot;redacted-secret-token&quot;,
                      &quot;cmd-args&quot;: &quot;config config-helper --format=json&quot;,
                      &quot;cmd-path&quot;: &quot;/usr/lib/google-cloud-sdk/bin/gcloud&quot;,
                      &quot;expiry&quot;: &quot;2022-10-20T16:25:25Z&quot;,
                      &quot;expiry-key&quot;: &quot;{.credential.token_expiry}&quot;,
                      &quot;token-key&quot;: &quot;{.credential.access_token}&quot;
                  }
              }
</code></pre>
<p>I'm guessing the command path points to the gcloud sdk which is used to get a new token when the current one expires. This works locally but on cloud functions it doesn't as there is no <code>/usr/lib/google-cloud-sdk/bin/gcloud</code></p>
<p>Is there a better way to authenticate or a way to access the gcloud binary from cloud functions?</p>

patrick_corrigan
<p>I have a similar mechanism (using Cloud Functions to authenticate to Kubernetes Engine) albeit written in Go.</p>
<p>This approach uses Google's <a href="https://cloud.google.com/kubernetes-engine/docs/reference/rest" rel="nofollow noreferrer">Kubernetes Engine API</a> to get the cluster's credentials and construct the <code>KUBECONFIG</code> using the values returned. This is equivalent to:</p>
<pre class="lang-bash prettyprint-override"><code>gcloud container clusters get-credentials ...
</code></pre>
<p><a href="https://developers.google.com/apis-explorer" rel="nofollow noreferrer">APIs Explorer</a> has a Node.js <a href="https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters/get#examples" rel="nofollow noreferrer">example</a> for the above method. The example uses <a href="https://github.com/googleapis/google-api-nodejs-client" rel="nofollow noreferrer">Google's API Client Library for Node.JS for Kubernetes Engine</a> also see <a href="https://googleapis.dev/nodejs/googleapis/latest/container/index.html" rel="nofollow noreferrer">here</a>.</p>
<p>There's also a <a href="https://cloud.google.com/nodejs/docs/reference/container/latest" rel="nofollow noreferrer">Google Cloud Client Library for Node.js for Kubernetes Engine</a> and this includes <a href="https://cloud.google.com/nodejs/docs/reference/container/latest/container/v1.clustermanagerclient#_google_cloud_container_v1_ClusterManagerClient_getCluster_member_1_" rel="nofollow noreferrer"><code>getCluster</code></a> which (I assume) is equivalent. Confusingly there's <a href="https://cloud.google.com/nodejs/docs/reference/container/latest/container/v1.clustermanagerclient#_google_cloud_container_v1_ClusterManagerClient_getServerConfig_member_1_" rel="nofollow noreferrer"><code>getServerConfig</code></a> too and it's unclear from reading the API docs as to the difference between these methods.</p>
<p>Here's a link to the <a href="https://gist.github.com/DazWilkin/9506c0b9677d53a3e11b7457ed21cbe7" rel="nofollow noreferrer">gist</a> containing my Go code. It constructs a Kubernetes <code>Config</code> object that can then be used by the Kubernetes API to authenticate you to a cluster..</p>
