Skip to main content

atmos gcp gke token

Resolve or refresh an Atmos GCP identity and emit its short-lived access token as Kubernetes ExecCredential JSON.

Usage​

atmos gcp gke token [--identity <identity>]

Examples​

atmos gcp gke token --identity example-deployer

The generated GKE kubeconfig invokes this command automatically. It writes only JSON to stdout; diagnostics go to stderr. The token is not written to kubeconfig or included in error messages.

Flags​

--identity, -i
The Atmos GCP identity to resolve. If omitted, Atmos uses ATMOS_IDENTITY or the only configured identity.

Output​

{
  "apiVersion": "client.authentication.k8s.io/v1beta1",
  "kind": "ExecCredential",
  "status": {
    "expirationTimestamp": "2026-08-07T12:30:00Z",
    "token": "example-redacted-token"
  }
}

The command uses the existing Auth manager, including valid cached credentials and provider refresh when required. It suppresses linked integration auto-provisioning during token resolution so the GKE integration cannot recursively rewrite its own kubeconfig.