title: Access Kubernetes GKE cluster outside of GKE cluster with client-go?
body: <ul>
  <li>I have multiple kubernetes clusters running on GKE (let's say clusterA and clusterB)</li>
  <li>I want to access both of those clusters from client-go in an app that is running in one of those clusters (e.g. access clusterB from an app that is running on clusterA)</li>
  </ul>
  
  <p>I general for authenticating with kubernetes clusters from client-go I see that I have two options:</p>
  
  <ul>
  <li>InCluster config</li>
  <li>or from kube config file</li>
  </ul>
  
  <p>So it is easy to access clusterA from clusterA but not clusterB from clusterA.</p>
  
  <p>What are my options here? It seems that I just cannot pass <code>GOOGLE_APPLICATION_CREDENTIALS</code> and hope that client-go will take care of itself.</p>
  
  <p>So my thinking:</p>
  
  <ul>
  <li>create a dedicated IAM service account</li>
  <li>create kube config with tokens for both clusters by doing <code>gcloud container clusters get-credentials clusterA</code> and <code>gcloud container clusters get-credentials clusterB</code></li>
  <li>use that kube config file in client-go via <code>BuildConfigFromFlags</code> on clusterA</li>
  </ul>
  
  <p>Is this the correct approach, or is there a simpler way? I see that tokens have an expiration date?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>It seems I can also use <code>CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud beta container clusters get-credentials clusterB --zone</code>. Which would add certificates to kube conf which I could use. But AFAIK those certificates cannot be revoked</p>