Unable to connect GCP GKE cluster using client-go with GCP service account key

[mickymics]

I want to connect GCP GKE cluster without setting GOOGLE_APPLICATION_CREDENTIALS, gcloud and kubeconfig.

When I use the basic authentication using username and password, I am able to connect. But when I am using GCP IAMservice account key, it always reporting error: cannot construct google default token source: google: could not find default credentials.

I am creating the GKE cluster on a fly using GKE APIs but GKE do not have support on cluster level and that's why I am using client-go sdk. But all the docs, github posts and blogs are saying to set ADC credentials. But without setting that and even without gcloud and kubectl how can I create kubernetes client with GCP IAM service account credential.

[mickymics]

@cjcullen can you provide me some idea of how to achieve the same

[ahmetb]

client-go auth/gcp plugin will just use GOOGLE_APPLICATION_CREDENTIALS.

If you want to authorize differently you should:

1. https://godoc.org/golang.org/x/oauth2/google package to get a oauth2.TokenSource, for example:

• e.g. https://godoc.org/golang.org/x/oauth2/google#JWTAccessTokenSourceFromJSON
• or https://godoc.org/golang.org/x/oauth2/google#DefaultTokenSource

2. Then use the oauth2.TokenSource to create an http.Client, via oauth2.NewClient https://godoc.org/golang.org/x/oauth2/google#DefaultTokenSource

3. Configure client-go and set its HTTP client with this http.Client, without using gcp auth plugin because you're now authenticating manually with this http.Client.

[csandanov]

@ahmetb as I understand you suggest something like:

restClient, _ := rest.RESTClientFor(restConfig)
restClient.Client = oauth2HTTPClient
clientSet := kubernetes.New(restClient)

the problem with this approach is that you have one config for all api groups, unlike when you use kubernetes.NewForConfig(restConfig) where each api group has its own http client with specific ContentConfig.GroupVersion which is required to have it working. So, in other words, you'll have to create a clientSet each time you want to work with another api group and that's completely unusable. I honestly don't understand why this New even exists.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.