A Kubeconfig for GKE That Doesn't Need gcloud

When you run gcloud container clusters get-credentials , the kubeconfig it writes looks innocent — until you hand it to a teammate and they hit: error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1beta1" …or the classic gke-gcloud-auth-plugin: executable not found . That's because the generated kubeconfig doesn't actually contain a credential. It contains an exec: block that shells out to gke-gcloud-auth-plugin , which in turn calls gcloud to mint a fresh OAuth token on every