# atmos gcp gke token

Resolve or refresh an Atmos GCP identity and emit its short-lived access token as Kubernetes `ExecCredential` JSON.

## Usage

```shell
atmos gcp gke token [--identity <identity>]
```

## Examples

```shell
atmos gcp gke token --identity example-deployer
```

The generated GKE kubeconfig invokes this command automatically. It writes only JSON to stdout; diagnostics go to stderr. The token is not written to kubeconfig or included in error messages.

## Flags

- **`--identity`, `-i`**
  The Atmos GCP identity to resolve. If omitted, Atmos uses 
  `ATMOS_IDENTITY`
   or the only configured identity.

## Output

```json
{
  "apiVersion": "client.authentication.k8s.io/v1beta1",
  "kind": "ExecCredential",
  "status": {
    "expirationTimestamp": "2026-08-07T12:30:00Z",
    "token": "example-redacted-token"
  }
}
```

The command uses the existing Auth manager, including valid cached credentials and provider refresh when required. It suppresses linked integration auto-provisioning during token resolution so the GKE integration cannot recursively rewrite its own kubeconfig.