Cannot change service account user gcloud gcp

Question

I still wondering how supposed to do to change the service account user. Let say I have 2 service account (A and B), which each user has different role in different project. After done being use user B, when I want to change to service account A and access the resource, gcloud command says

Error from server (Forbidden): pods is forbidden: User "user-B@project.iam.gserviceaccount.com" cannot list resource "pods" in API group "" in the namespace "default": requires one of ["container.pods.list"] permission(s).

I'm done change my service account user with gcloud config set account [service-account], but the gcloud still read another service account. Did I missed something?

Answer 1

Here's a contrived example of what I think you're doing:

# gcloud is using my regular User credentials
gcloud config get account
me@gmail.com

# Access GKE as me@gmail.com
kubectl get pods --namespace=default
pod/foo-c7b7995df-vxrmh

# Authenticate as a GCP Service Account with **no** permissions
EMAIL="{ACCOUNT}@{PROJECT}.iam.gserviceaccount.com"
gcloud auth activate-service-account ${EMAIL} \
--key-file=${KEY_FILE}

# gcloud is now using the Service Account credentials
gcloud config get account
${EMAIL}

# Using new GKE auth plugin
gke-gcloud-auth-plugin \
| jq -r .status.expirationTimestamp
2022-00-00T17:10:00Z

# Need to either delete the token
# Or wait until 17:10 for it to expire
# Then...
kubectl get pods --namespace=default
Error from server (Forbidden): pods is forbidden: ...

ERROR Error from server (Forbidden): pods is forbidden: User "{ACCOUNT}@{PROJECT}.iam.gserviceaccount.com" cannot list resource "pods" in API group "" in the namespace "default": requires one of ["container.pods.list"] permission(s).

One solution is to grant the GCP (!) Service Account one of the Kubernetes Engine roles that has permission to list Pods, i.e. container.pods.* which is part of roles/container.developer:

# Grant the Service Account Kubernetes Engine role
ROLE="roles/container.developer"
gcloud projects add-iam-policy-binding ${PROJECT} \
--member=serviceAccount:${EMAIL} \
--role=${ROLE}

# Try again
kubectl get pods --namespace=default --output=name
pod/foo-c7b7995df-vxrmh