kubectl和GKE (Google Kubernetes Engine)未经授权的问题

Question

在尝试使用Kubectl与Google Kubernetes引擎集群进行交互时，我遇到了一个未经授权的问题。

Kubectl以前工作过。然后，我使用gcloud container clusters resize将节点缩减到零节点。今天重新扩展，我遇到了以下错误：

$ gcloud container clusters get-credentials my-cluster-1 --zone europe-west2-c --project my-proj
Fetching cluster endpoint and auth data.
kubeconfig entry generated for my-cluster-1
$ kubectl cluster-info 

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
error: You must be logged in to the server (Unauthorized)

奇怪的是，这似乎是间歇性的-它今天再次工作并停止-会不会是访问令牌到期了？有什么调试技巧吗？我不喜欢Cloud shell，所以我使用本地Shell。

编辑：

λ kubectl config current-context
gke_my-proj_europe-west2-c_my-cluster-1

奇怪的是，kubectl cluster-info dump成功地执行并转储了所有对象和日志。

更多信息：

vozzy@local ~ λ rm .kube/config 
vozzy@local ~ λ gcloud container clusters get-credentials my-cluster-1 --zone europe-west2-c --project my-proj
Fetching cluster endpoint and auth data.
kubeconfig entry generated for my-cluster-1.
vozzy@local ~ λ /usr/lib64/google-cloud-sdk/bin/gcloud config config-helper --format=json{
  "configuration": {
    "active_configuration": "default",
    "properties": {
      "compute": {
        "region": "europe-west2-c",
        "zone": "europe-west2"
      },
      "core": {
        "account": "v.osborne.dev@gmail.com",
        "disable_usage_reporting": "True",
        "project": "my-proj"
      }
    }
  },
  "credential": {
    "access_token": "x",
    "id_token": "y.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIzMjU1NTk0MDU1OS5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6IjMyNTU1OTQwNTU5LmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTEwNjc4MTY3NjU0ODU3MTEyMjQ1IiwiZW1haWwiOiJ2Lm9zYm9ybmUuZGV2QGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiTHBfVnFzUE1CaS1kNEdhS2p2R082USIsImlhdCI6MTU5MTYxMjYzOCwiZXhwIjoxNTkxNjE2MjM4fQ.XDHJ3S9BYupnhYMfU6Hi5ir6CqxB0umle2Ho34ieiQ8nmWDa1xysHfSo5boBMD6xvn1D1TNzMoMwZRSX13cTchaT9Fv-vauAMjg5Ze30m8sGqgsbGHsbloHNkQ-M0NOsa_JkbUzwTgcxhZx1vFuVgObhHb9fbXxGwtA9hsDMZBhCoD3DlSNKxQoisr44pXdP53d3GHCZXZde2DoeNdgCZvOCnJ8h7Z1cbn5BJyQqMoVByBk7PuJtaLZuUFM52jluaRau95xIvugUQTb2ftcNVGIG8-A9NfzYTKWlFDD8nEuCscTKkcXdb3-_rMGA_1zs95qJSTAxVETIGekijn0dUw",
    "token_expiry": "2020-06-07T21:42:05Z"
  },
  "sentinels": {
    "config_sentinel": "/home/vozzy/.config/gcloud/config_sentinel"
  }
}
vozzy@local ~ λ cat .kube/config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURERENDQWZTZ0F3SUJBZ0lSQU16eVJGbjAxeDVxV1lLUVZxN2J1clF3RFFZSktvWklodmNOQVFFTEJRQXcKTHpFdE1Dc0dBMVVFQXhNa09USTVOakZtTURBdFltVm1NeTAwWWpWbExUZ3pPV1l0WlRjNE5qa3pOREpqWm1RMgpNQjRYRFRJd01EWXdOekV4TVRneE9Wb1hEVEkxTURZd05qRXlNVGd4T1Zvd0x6RXRNQ3NHQTFVRUF4TWtPVEk1Ck5qRm1NREF0WW1WbU15MDBZalZsTFRnek9XWXRaVGM0Tmprek5ESmpabVEyTUlJQklqQU5CZ2txaGtpRzl3MEIKQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBc2JycVdraUVXdW5XYTBLQUN4czRuajBmWXFTalV5L3ZRQlJqSnNkeQpKN1A3MUZ5ejdrWFowRjNieks4aExqTDl0U2RRaG9aRmtxMDJXYWdvS2J2eVJ1WVRsOUY0T0xKbmNoOG9idm84CkxQaGlmcmRxdVp5bjhlVmFMNlpOWjVZR2lJMWJsYXN2eDJuSlRYdUkvTUhyQkdoUjNrZ2FYenpPU1BSSDM4RGgKb3RkWFpBWUpKdFJqNCt6dmMxbXJRNDFjRVlmVGRLRlVlV2p3VU41LzlFOFhTbGxTSzZ0dkR0UnRTZTdvbTZIQgo5RHhpN3hnT041aWZIZGhldjNEN2ZmQndaQnQ1Q1pGSmJLc3BTNjE0T3FOQUVWNDdNVld1TkppemZlUWszc3BkClMzbkNlYW9IaEUrcWkyS1JmZCs4LzZRbDhicjNTcGdIZ3JtcGNhWTRLaGdQc1FJREFRQUJveU13SVRBT0JnTlYKSFE4QkFmOEVCQU1DQWdRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQQpoLzFDRmZZeUYzZjQrSGVOVTNjdnc0eWIvUXlOdUFVdlg5MjB3Z2JrRUhRNFhnMHNibFAvTTgrSmRrVGpQTWI4CmhRMnV3Y0lNK2xPdWMzTVdHT0FyRWdQWmhDZEZBWldhQTJDOWVBUUVTRXpoQ2N4YWk1SGJKK0o5NmNSd1BQTmMKUHpKM3l1N3RFTEFZdVZzY2E3dk1SeTd3eG02R1hRYUtQc1hCdlRvT2xQL2xvNFVyU2lHam9MNXAwTStWU2MvQwpaZHRFaUdjeXdWZ3BPWXQvazd1cjg1a3JBMVdROHNnRDl6M3U5bkFGbThjZDY1MXNiZEwvb1c3V3dOY2NPRnlhCk9rM3FWVjltdVZRY1JKOXVSZ1dQbnNLQ0JlWUUrU1RzZEpXb1JaQWlWWG5OU2d1SytrcVZCMUY5cnhEZVVmQjcKM2FQTHVhaUpJSHBYMjFSY2tvVkFQZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://111
  name: gke_my-proj_europe-west2-c_my-cluster-1
contexts:
- context:
    cluster: gke_my-proj_europe-west2-c_my-cluster-1
    user: gke_my-proj_europe-west2-c_my-cluster-1
  name: gke_my-proj_europe-west2-c_my-cluster-1
current-context: gke_my-proj_europe-west2-c_my-cluster-1
kind: Config
preferences: {}
users:
- name: gke_my-proj_europe-west2-c_my-cluster-1
  user:
    auth-provider:
      config:
        cmd-args: config config-helper --format=json
        cmd-path: /usr/lib64/google-cloud-sdk/bin/gcloud
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp
vozzy@local ~ λ kubectl get pods
error: You must be logged in to the server (Unauthorized)

他们的访问令牌似乎已经过期了。gcloud auth login不会更新它

Answer 1

运行下面的命令将解决此问题：

gcloud container clusters get-credentials cluster_name --region region_name --project project_name