This document describes how to authenticate to Google Kubernetes Engine programmatically. How
you authenticate to Google Kubernetes Engine depends on the interface you use to access the API
and the environment where your code is running.
The GKE API lets you interact with
the Google Cloud infrastructure that runs Kubernetes, like your
GKE clusters and nodes.
To interact with Kubernetes objects like Pods and Services, you must
authenticate to the Kubernetes API, which is separate to the
GKE API and is served by the Kubernetes API server in each
cluster. For instructions, see
Authenticate to the Kubernetes API server.
The GKE client libraries provide
high-level language support for authenticating to GKE
programmatically.
To authenticate calls to Google Cloud APIs, client libraries support
Application Default Credentials (ADC);
the libraries look for credentials in a set of defined locations and use those credentials
to authenticate requests to the API. With ADC, you can make
credentials available to your application in a variety of environments, such as local
development or production, without needing to modify your application code.
Google Cloud CLI
When you use the gcloud CLI to access
GKE, you
log in to the gcloud CLI with a user
account, which provides the credentials used by the gcloud CLI commands.
If your organization's security policies prevent user accounts from having the required
permissions, you can use service account impersonation.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Authenticate to GKE\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\n\nThis document describes how to authenticate to Google Kubernetes Engine programmatically. How\nyou authenticate to Google Kubernetes Engine depends on the interface you use to access the API\nand the environment where your code is running.\nThe GKE API lets you interact with the Google Cloud infrastructure that runs Kubernetes, like your GKE clusters and nodes.\n\n\u003cbr /\u003e\n\nTo interact with *Kubernetes objects* like Pods and Services, you must\nauthenticate to the Kubernetes API, which is separate to the\nGKE API and is served by the Kubernetes API server in each\ncluster. For instructions, see\n[Authenticate to the Kubernetes API server](/kubernetes-engine/docs/how-to/api-server-authentication).\n\nTo access other Google Cloud resources like Cloud Storage buckets\nfrom workloads running in GKE, use\n[Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity).\n\n\nFor more information about Google Cloud authentication, see the\n[Authentication methods](/docs/authentication).\n\nAPI access\n----------\n\n\nGKE supports programmatic access. You can access the API in\nthe following ways:\n\n- [Client libraries](#client-libraries)\n- [Google Cloud CLI](#gcloud)\n- [REST](#rest)\n\n### Client libraries\n\n\nThe [GKE client libraries](/kubernetes-engine/docs/reference/libraries) provide\nhigh-level language support for authenticating to GKE\nprogrammatically.\n\n\nTo authenticate calls to Google Cloud APIs, client libraries support\n[Application Default Credentials (ADC)](/docs/authentication/application-default-credentials);\nthe libraries look for credentials in a set of defined locations and use those credentials\nto authenticate requests to the API. With ADC, you can make\ncredentials available to your application in a variety of environments, such as local\ndevelopment or production, without needing to modify your application code.\n\n### Google Cloud CLI\n\n\nWhen you use the [gcloud CLI](/sdk/gcloud/reference/container/clusters) to access\nGKE, you\n[log in to the gcloud CLI](/sdk/docs/authorizing) with a user\naccount, which provides the credentials used by the gcloud CLI commands.\n\n\nIf your organization's security policies prevent user accounts from having the required\npermissions, you can use [service account impersonation](#sa-impersonation).\n\nFor more information, see\n[Authenticate for using the gcloud CLI](/docs/authentication/gcloud).\nFor more information about using the gcloud CLI with GKE,\nsee [the gcloud CLI reference pages](/sdk/gcloud/reference/container/clusters).\n\n\n### REST\n\n\nYou can authenticate to\n[the GKE API](/kubernetes-engine/docs/reference/rest)\nby using your gcloud CLI credentials or by using\n[Application Default Credentials](/docs/authentication/application-default-credentials).\nFor more information about authentication for REST requests, see\n[Authenticate for using REST](/docs/authentication/rest).\nFor information about the types of credentials, see\n[gcloud CLI credentials and ADC credentials](/docs/authentication/gcloud#gcloud-credentials).\n\nWhat's next\n-----------\n\n- [Authenticate to the Kubernetes API server](/kubernetes-engine/docs/how-to/api-server-authentication).\n- [Use external identity providers to authenticate to GKE](/kubernetes-engine/docs/how-to/oidc).\n- [Authenticate to Google Cloud APIs from GKE using Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity).\n- [Learn about access control in GKE and Kubernetes](/kubernetes-engine/docs/concepts/access-control).\n- [Learn about the GKE API and the Kubernetes API](/kubernetes-engine/docs/reference/api-organization).\n- Learn about [Google Cloud authentication methods](/docs/authentication#auth-decision-tree).\n- See a list of [authentication use cases](/docs/authentication/use-cases)."]]
