title: How to use kubectl from a CronJob in GKE?
body: <p>I deployed a CronJob in a GKE cluster to periodically replicate secrets in namespaces (for <code>cert-manager</code>), but I always get the following error:</p>
  
  <pre><code>The connection to the server localhost:8080 was refused - did you specify the right host or port?
  </code></pre>
  
  <p>Here is my deployment:</p>
  
  <pre><code>apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: certificate-replicator-cron-job
    namespace: default
  spec:
    jobTemplate:
      spec:
        template:
          metadata:
            labels:
              app: default
              release: default
          spec:
            automountServiceAccountToken: false
            containers:
            - command:
              - /bin/bash
              - -c
              - for i in $(kubectl get ns -o json |jq -r ".items[].metadata.name" |grep
                "^bf-"); do kubectl get secret -o json --namespace default dev.botfront.cloud-staging-tls
                --export |jq 'del(.metadata.namespace)' |kubectl apply -n ${i}-f -;  done
              image: bitnami/kubectl:latest
              name: certificate-replicator-container
            restartPolicy: OnFailure
            serviceAccountName: sa-certificate-replicator
    schedule: '* * * * *'
  </code></pre>
  
  <p>I also set up a role for the service account:</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ kubectl describe role certificate-replicator-role                                                                                                                                 
  Name:         certificate-replicator-role
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  PolicyRule:
    Resources   Non-Resource URLs  Resource Names  Verbs
    ---------   -----------------  --------------  -----
    secrets     []                 []              [list create get]
    namespaces  []                 []              [list get]
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>$ kubectl describe rolebinding certificate-replicator-role-binding                                                                                                                  git:(master|✚4…
  Name:         certificate-replicator-role-binding
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  Role:
    Kind:  Role
    Name:  certificate-replicator-role
  Subjects:
    Kind            Name                       Namespace
    ----            ----                       ---------
    ServiceAccount  sa-certificate-replicator  default
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>$ kubectl describe serviceaccount sa-certificate-replicator                                                                                                                         git:(master|✚4…
  Name:                sa-certificate-replicator
  Namespace:           default
  Labels:              &lt;none&gt;
  Annotations:         &lt;none&gt;
  Image pull secrets:  &lt;none&gt;
  Mountable secrets:   sa-certificate-replicator-token-ljsfb
  Tokens:              sa-certificate-replicator-token-ljsfb
  Events:              &lt;none&gt;
  </code></pre>
  
  <p>I understand that I could probably create another Docker image with <code>gcloud</code> preinstalled and authenticate with a service account key, but I'd like to be cloud provider agnostic and also avoid having to authenticate to the cluster since <code>kubectl</code> is being invoked from inside.</p>
  
  <p>Is that possible?</p>