title: Python client for accessing kubernetes cluster on GKE
body: <p>I am struggling to programmatically access a kubernetes cluster running on Google Cloud. I have set up a service account and pointed <code>GOOGLE_APPLICATION_CREDENTIALS</code> to a corresponding credentials file. I managed to get the cluster and credentials as follows:</p>
  
  <pre class="lang-py prettyprint-override"><code>import google.auth
  from google.cloud.container_v1 import ClusterManagerClient
  from kubernetes import client
  
  credentials, project = google.auth.default(
      scopes=['https://www.googleapis.com/auth/cloud-platform',])
  
  credentials.refresh(google.auth.transport.requests.Request())
  
  cluster_manager = ClusterManagerClient(credentials=credentials)
  cluster = cluster_manager.get_cluster(project, 'us-west1-b', 'clic-cluster')
  </code></pre>
  
  <p>So far so good. But then I want to start using the kubernetes client:</p>
  
  <pre class="lang-py prettyprint-override"><code>config = client.Configuration()
  config.host = f'https://{cluster.endpoint}:443'
  config.verify_ssl = False
  config.api_key = {"authorization": "Bearer " + credentials.token}
  config.username = credentials._service_account_email
  
  client.Configuration.set_default(config)
  
  kub = client.CoreV1Api()
  print(kub.list_pod_for_all_namespaces(watch=False))
  </code></pre>
  
  <p>And I get an error message like this:</p>
  
  <p><em><strong>pods is forbidden: User "12341234123451234567" cannot list resource "pods" in API group "" at the cluster scope: Required "container.pods.list" permission.</strong></em></p>
  
  <p>I found <a href="https://cloud.google.com/kubernetes-engine/docs/reference/api-permissions" rel="nofollow noreferrer">this website</a> describing the <code>container.pods.list</code>, but I don't know where I should add it, or how it relates to the API scopes <a href="https://developers.google.com/identity/protocols/googlescopes" rel="nofollow noreferrer">described here</a>.</p>