Gcloud and Kubectl see me logged in as two different users

Mac here, in case it makes a difference. I am on 2 separate GCP/gcloud/GKE/Kubernetes projects and have two different gmails for each of them:

Project 1: flim-flam, where my email is myuser1@gmail.example.com (pretend its a gmail)
Project 2: foo-bar, where my email is myuser2@gmail.example.com

I log into my myuser1@gmail.example.com account via gcloud auth login and confirm I am logged in as that account. For instance, I go to the GCP console and verify (in the UI) that I am in fact logged in as myuser1@gmail.example.com. Furthermore, when I run gcloud config configurations list I get:

NAME       IS_ACTIVE  ACCOUNT                    PROJECT        COMPUTE_DEFAULT_ZONE  COMPUTE_DEFAULT_REGION
flim-flam  True       myuser1@gmail.example.com  flim-flam
foo-bar    False      myuser2@gmail.example.com  foo-bar

From my flim-flam project, when I run kubectl delete ns flimflam-app I get permission errors:

Error from server (Forbidden): namespace "flimflam-app" is forbidden: User "myuser2@gmail.example.com" cannot delete resource "namespaces" in API group "" in the namespace "flimflam-app": requires one of ["container.namespaces.delete"] permission(s).

So gcloud thinks I'm logged in as myuser1 but kubectl thinks I'm logged in as myuser2. How do I fix this?

Solution

gcloud and kubectl share user identities but their configuration is in different files.

Using gcloud auth login does not update (!) existing (!) kubectl configurations. The former (on Linux) are stored in ${HOME}/.config/gcloud and the latter in ${HOME}/.kube/config.

I don't have a copy on hand but, if you check ${HOME}/.kube/config, it likely references the other Google account. You can either duplicate the users entry and reference it from the context. Or you could edit the existing users entry.

Actually, better yet use gcloud container clusters get-credentials to update kubectl's configuration with the currently-active gcloud user. This command updates ${HOME}/.kube/config for you.