I was prompted by a question on Stack overflow “How to remove warning in kubectl with gcp auth plugin?” to try this new mechanism for myself. It’s described by Google in the a post Here’s what to know about changes to kubectl authentciation coming in GKE v1.25.

One question I’d not considered is: how is the change manifest? Thinking about it, I realized it’s probably evident in the users section of kubectl config. A long time, I wrote a blog post Kubernetes Engine: kubectl config that explains how kubectl leverages (!) gcloud to get an access token for GKE.

gcloud container clusters create is a complex command. The --cluster-version flag, often combined with --release-channel in order to have Google maintain the master and node versions, take values that are provided by gcloud container get-server-config.

The available Kubernetes versions differs by region and by zone:

gcloud container get-server-config \
--project=${PROJECT} \
--zone=us-west2-c

Yields:

channels:
- channel: RAPID
  defaultVersion: 1.21.3-gke.2001
  validVersions:
  - 1.21.4-gke.301
  - 1.21.3-gke.2001

Whereas:

gcloud container get-server-config \
--project=${PROJECT} \
--region=us-west2

Yields

channels:
- channel: RAPID
  defaultVersion: 1.21.4-gke.301
  validVersions:
  - 1.21.4-gke.1801
  - 1.21.4-gke.301

I assume the divergence results from a controlled rollout of Kubernetes versions across regions and zones.