<p>I am trying to invoke kubectl from within my CI system. I wish to use a google cloud service account for authentication. I have a secret management system in place that injects secrets into my CI system.</p>

<p>However, my CI system does not have gcloud installed, and I do not wish to install that. It only contains kubectl. Is there any way that I can use a credentials.json file containing a gcloud service account (not a kubernetes service account) directly with kubectl?</p>

Alex Flint
<p>The easiest way to skip the gcloud CLI is to probably use the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#option-2-use-the-token-option" rel="noreferrer"><code>--token</code></a> option. You can get a token with RBAC by creating a service account and tying it to a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="noreferrer"><code>ClusterRole</code> or <code>Role</code></a> with either a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="noreferrer"><code>ClusterRoleBinding</code> or <code>RoleBinding</code></a>.</p>

<p>Then from the command line:</p>

<pre><code>$ kubectl --token &lt;token-from-your-service-account&gt; get pods
</code></pre>

<p>You still will need a <code>context</code> in your <code>~/.kube/config</code>:</p>

<pre><code>- context:
    cluster: kubernetes
  name: kubernetes-token
</code></pre>

<p>Otherwise, you will have to use:</p>

<pre><code>$ kubectl --insecure-skip-tls-verify --token &lt;token-from-your-service-account&gt; -s https://&lt;address-of-your-kube-api-server&gt;:6443 get pods
</code></pre>

<p>Note that if you don't want the token to show up on the logs you can do something like this:</p>

<pre><code>$ kubectl --token $(cat /path/to/a/file/where/the/token/is/stored) get pods
</code></pre>

<p>Also, note that this doesn't prevent you from someone running <code>ps -Af</code> on your box and grabbing the token from there, for the lifetime of the <code>kubectl</code> process (It's a good idea to rotate the tokens)</p>

<p>Edit:</p>

<p>You can use the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file" rel="noreferrer"><code>--token-auth-file=/path/to/a/file/where/the/token/is/stored</code></a> with <code>kubectl</code> to avoid passing it through <code>$(cat /path/to/a/file/where/the/token/is/stored)</code></p>
