How to authenticate to google-cloud-sdk using user account in non-interactive mode

Question

When I am authenticating using service-account.json I am not able to access any projects, i.e. the command 'gcloud projects list' results in

Listed 0 items.

Setting gcloud project using the command 'gcloud config set project my-project' results in:

WARNING: You do not appear to have access to project [my-project] or it does not exist.

But this project is present in my service-account.json I am trying to get my GKE cluster credentials to create a kubeconfig entry. 'gcloud container clusters get-credentials my-cluster --zone=us-central1-a'

ERROR: (gcloud.container.clusters.get-credentials) ResponseError: code=403, message=Required "container.clusters.get" permission(s) for "projects/my-project/zones/us-central1-a/clusters/my -cluster".

When I log in to GCP using gcloud init and logging in with user account all these steps are giving successful results. But how should I authorise user account without opening browser. I cannot use '--console-only' flag as it still requires to copy-paste url and opening browser. I want to automate the full process of authenticating to user account by only using scripts

NOTE: The my-cluster GKE cluster was created under my-project and was created by me.

Answer 1

I suspect (!?) your service account has insufficient permissions (granted through roles).

To list projects (gcloud projects list), the service account must have (at least) resourcemanager.projects.get on (each of the projects) in the list. See:

https://cloud.google.com/resource-manager/docs/access-control-proj#permissions_and_roles

To retrieve cluster permissions, it must have container.clusters.get (see full list).

A good role that includes both is roles/container.clusterAdmin)

Service Accounts are challenging. They are both resources (particles) and identities (waves) and behave differently depending on context.

As resources, Service Accounts are created in (and owned) by a Project and may be granted permissions in any project (not just the owner).

As identities, Service Accounts may be granted roles that aggregate permissions to one of more methods. It is this step that I think you may be missing.

Google's IAM documentation is decent.