What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.):

kubectl token

BUG REPORT

Kubernetes version (use kubectl version):
kubectl version
Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.0", GitCommit:"fff5156092b56e6bd60fff75aad4dc9de6b6ef37", GitTreeState:"clean", BuildDate:"2017-03-28T16:36:33Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.1", GitCommit:"b0b7a323cc5a4a2019b2e9520c21c7830b7f708e", GitTreeState:"clean", BuildDate:"2017-04-03T20:33:27Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration:
  GKE

• OS (e.g. from /etc/os-release):
  macOS Sierra 10.12.4

• Kernel (e.g. uname -a):
  ➜ uname -a
  Darwin jacobsimpson-macbookpro.roam.corp.google.com 16.5.0 Darwin Kernel Version 16.5.0: Fri Mar 3 16:52:33 PST 2017; root:xnu-3789.51.2~3/RELEASE_X86_64 x86_64

• Install tools:

• Others:

What happened:
I set up a second user, then I use kubectl --token to authenticate as the second user. The --token parameter is ignored and the authentication token from the ~/.kube/config file is used instead, so I'm authenticated as the user configured in the config file, not as the user set on the command line parameters.

I further verified this by commenting out the section in the config file with the authentication token and then the --token parameter starts to work as expected.

What you expected to happen:
I expect the command line parameters, when present, to override the config file settings.

How to reproduce it (as minimally and precisely as possible):

gcloud container clusters create test-cluster --cluster-version=1.6.1
primary_account=$(gcloud auth list 2>&1 | grep ACTIVE | sed 's/.*- \([^ ]*\) .*/\1/')
admin_token="$(gcloud auth print-access-token --account=$primary_account)"
gcloud iam service-accounts create user-1 --display-name=user-1
user_account=$(gcloud iam service-accounts list --format='value(email)' --filter='displayName:user-1')
gcloud iam service-accounts keys create --iam-account $user_account user_key.json
gcloud auth activate-service-account $user_account --key-file=user_key.json
user_token="$(gcloud auth print-access-token --account=$user_account)"
kubectl --token="$admin_token" get nodes

At this point, the error message should be indicating kubectl tried to authenticate with the user-1 account. Something like this:

➜  kubectl --token="$admin_token" get nodes
Error from server (Forbidden): User "user-1@project-name.iam.gserviceaccount.com" cannot list nodes at the cluster scope.: "No policy matched.\nRequired \"container.nodes.list\" permission." (get nodes)

Now edit ~/.kube/config, search for the auth-provider: section for your cluster and comment out the whole section for the test cluster.

- name: test-cluster
  user:
    #auth-provider:
    #  config:
    #    access-token: ya29.xxxxx
    #    cmd-args: config config-helper --format=json
    #    cmd-path: /.../gcloud
    #    expiry: 2017-04-11T21:06:25Z
    #    expiry-key: '{.credential.token_expiry}'
    #    token-key: '{.credential.access_token}'
    #  name: gcp

Now it should be possible to run these two commands. The one using the $admin_token will succeed, the one using the $user_token will fail with the error message indicating the user name.

kubectl --token="$admin_token" get nodes
kubectl --token="$user_token" get nodes

Anything else we need to know: