--- title: Authenticate against GKE without gcloud | daily.dev description: A workaround is provided for authenticating kubectl against Google Kubernetes Engine (GKE) clusters without installing gcloud or requiring interactive browser... canonical: https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Authenticate against GKE without gcloud | daily.dev og:description: A workaround is provided for authenticating kubectl against Google Kubernetes Engine (GKE) clusters without installing gcloud or requiring interactive browser... og:url: https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi og:image: https://api.daily.dev/og/posts/B6bAIS7yI.png og:image:alt: Authenticate against GKE without gcloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Authenticate against GKE without gcloud **[Teleport](https://daily.dev/sources/teleport)** · 4 min read · 0 upvotes · 0 comments ## Summary A workaround is provided for authenticating kubectl against Google Kubernetes Engine (GKE) clusters without installing gcloud or requiring interactive browser login. After obtaining GKE credentials once through the standard gcloud workflow, a sample script uses the Kubernetes CSR API to request a new certificate, producing a kubeconfig file that can be placed on CI/CD machines for automation. Note is made that certificates returned by the CSR API don't expire, and Teleport is mentioned as an alternative for rotating credentials and unifying SSH/Kubernetes access. An update references a Google engineer's alternative approach using a static kubeconfig copied from a gcloud-enabled workstation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I authenticate kubectl to a GKE cluster without installing gcloud? Obtain GKE credentials once using the standard gcloud workflow, then use the Kubernetes CSR API to request a new client certificate instead of relying on gcloud for ongoing authentication. A sample script handles the CSR request and produces a kubeconfig file that works independently of gcloud, suitable for CI/CD machines and automation. _daily.dev surfaces practical Kubernetes automation guides like this for teams building CI/CD pipelines._ ### Do certificates issued by the Kubernetes CSR API for GKE authentication expire? No, certificates returned by the Kubernetes CSR API in this setup do not have an expiration date and continue working indefinitely. Teams wanting automatic rotation need to build their own tooling around this or use a third-party access gateway such as Teleport, which provides unified SSH and Kubernetes access management. _Developers managing long-lived credentials can track infrastructure security practices on daily.dev._ ## Similar posts on daily.dev - [Kubernetes User Authentication with Client Certificates and RBAC](https://daily.dev/posts/kubernetes-user-authentication-with-client-certificates-and-rbac-qvbi0zovt) · Towards Dev · 3 upvotes · 0 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Same App, Two Clouds: Migrating from EKS to GKE with Kustomize Overlays](https://daily.dev/posts/same-app-two-clouds-migrating-from-eks-to-gke-with-kustomize-overlays-ndfrvocib) · ITNEXT · 0 upvotes · 0 comments - [How to Encrypt Kubernetes Traffic with cert-manager, Let's Encrypt, and Internal TLS](https://daily.dev/posts/how-to-encrypt-kubernetes-traffic-with-cert-manager-let-s-encrypt-and-internal-tls-9zjo9p9lm) · freeCodeCamp · 14 upvotes · 1 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#cicd](https://daily.dev/tags/cicd), [#authentication](https://daily.dev/tags/authentication), [#gke](https://daily.dev/tags/gke) [View this post on daily.dev](https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Authenticate against GKE without gcloud","url":"https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi"},"datePublished":"2026-08-23T12:22:06.692Z","dateModified":"2026-08-23T12:43:01.387Z","description":"A workaround is provided for authenticating kubectl against Google Kubernetes Engine (GKE) clusters without installing gcloud or requiring interactive browser...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,cicd,authentication,gke","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Authenticate against GKE without gcloud"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/authenticate-against-gke-without-gcloud-b6bais7yi#faq","mainEntity":[{"@type":"Question","name":"How do I authenticate kubectl to a GKE cluster without installing gcloud?","acceptedAnswer":{"@type":"Answer","text":"Obtain GKE credentials once using the standard gcloud workflow, then use the Kubernetes CSR API to request a new client certificate instead of relying on gcloud for ongoing authentication. A sample script handles the CSR request and produces a kubeconfig file that works independently of gcloud, suitable for CI/CD machines and automation. daily.dev surfaces practical Kubernetes automation guides like this for teams building CI/CD pipelines."}},{"@type":"Question","name":"Do certificates issued by the Kubernetes CSR API for GKE authentication expire?","acceptedAnswer":{"@type":"Answer","text":"No, certificates returned by the Kubernetes CSR API in this setup do not have an expiration date and continue working indefinitely. Teams wanting automatic rotation need to build their own tooling around this or use a third-party access gateway such as Teleport, which provides unified SSH and Kubernetes access management. Developers managing long-lived credentials can track infrastructure security practices on daily.dev."}}]} ```