Possiblity to not export CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

まず auth action の credentials_json 処理と、CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE のエクスポートから始めます。gcloud 579.0.0 と gke-gcloud-auth-plugin を使って auth + setup-gcloud ワークフローを再現し、その後、変数の設定を解除する回避策なしで kubectl が成功することを確認します。

TL;DR

Since gcloud 571.0.0, the CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE variable this action exports makes gcloud config config-helper crash when the credential is a service account key:

ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

gke-gcloud-auth-plugin calls config config-helper to fetch its token, so every kubectl command against GKE fails. The underlying regression is in gcloud, not in this action (details below), but right now there is no combination of inputs that keeps the documented auth + setup-gcloud action pairing working with credentials_json on recent gcloud versions.

Expected behavior

kubectl works after auth + setup-gcloud + gcloud container clusters get-credentials, as it does with gcloud <= 570.

Observed behavior

Same workflow with gcloud 579.0.0 fails on the first kubectl call:

E0811 14:17:06.408098     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
F0811 14:17:07.297179     281 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)

Action YAML

name: Test S3NS gcloud login
run-name: Test S3NS gcloud login

env:
  # See https://cloud.google.com/sdk/docs/release-notes
  GCLOUD_VERSION: 579.0.0

jobs:
  test-s3ns-login:
    name: kubectl get pods on s3ns nonprod
    runs-on: ubuntu-24.04
    env:
      CLUSTER: nonprod
      KUBECONFIG: /home/runner/_work/kube/config

    steps:
      - name: retrieve s3ns credentials from SSM
        id: retrieve-s3ns-credentials
        shell: bash
        run: |
          # the ssm parameter contains the base64 encoded json key file, minified
          # to one line with `jq -c` so GitHub log masking stays sane
          echo "CREDENTIALS_JSON_MINIFIED=$(aws ssm get-parameter --name "/redacted/path/to/sa-key.json" --with-decryption --query Parameter.Value --output text | base64 -d | jq -c .)" >> "${GITHUB_OUTPUT}"

      - name: login to s3ns
        id: auth
        uses: google-github-actions/auth@v3
        with:
          universe: s3nsapis.fr
          credentials_json: ${{ steps.retrieve-s3ns-credentials.outputs.CREDENTIALS_JSON_MINIFIED }}

      # Requires that action google-github-actions/auth has run before
      - name: Install gcloud cli
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: s3ns:redacted-${{ env.CLUSTER }}
          install_components: gke-gcloud-auth-plugin
          version: ${{ env.GCLOUD_VERSION }}

      - name: Generate kubeconfig for s3ns cluster
        shell: bash
        run: |
          S3NS_CLUSTER_REGION='u-france-east1'
          gcloud config set project "s3ns:redacted-${CLUSTER}"
          gcloud container clusters get-credentials "${CLUSTER}" --region="${S3NS_CLUSTER_REGION}"

      - name: kubectl get pods
        shell: bash
        run: |
          # unset CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE -> it works if this is not commented
          kubectl get pods --all-namespaces

Log output

Run kubectl get pods --all-namespaces
F0811 14:17:04.098709     220 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)
E0811 14:17:04.099350     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
F0811 14:17:04.760927     235 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)
E0811 14:17:04.761521     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
F0811 14:17:05.533417     250 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)
E0811 14:17:05.533976     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
F0811 14:17:06.407594     266 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)
E0811 14:17:06.408098     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
F0811 14:17:07.297179     281 cred.go:150] print credential failed with error: failed to retrieve access token: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: gcloud crashed (AttributeError): 'Credentials' object has no attribute 'private_key_id'

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
)
E0811 14:17:07.297628     211 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://177.222.75.61/api?timeout=32s\": getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1"
Unable to connect to the server: getting credentials: exec: executable gke-gcloud-auth-plugin failed with exit code 1
Error: Process completed with exit code 1.

Additional information

I've made sure that the changes appears with gcloud cli >= 571

doing

unset CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

before kubectl solves the bug, but it's a workaround rather than a fix.