🚨 GCP Error: 'gke-gcloud-auth-plugin not found' — Cause, Fix, and Troubleshooting Guide

Overview

Since Kubernetes client 1.26, GKE authentication moved out of the in-tree gcp auth provider and into a standalone binary, gke-gcloud-auth-plugin. If that plugin is missing (or the kubeconfig still references the old provider), kubectl fails before it can even authenticate:

Unable to connect to the server: getting credentials: exec: executable
gke-gcloud-auth-plugin not found

It looks like you are trying to use a client-go credential plugin that is not
installed.

Or, with an old kubeconfig:

error: The gcp auth plugin has been removed.
Please use the "gke-gcloud-auth-plugin" kubectl/exec credential plugin instead.
no Auth Provider found for name "gcp"

Symptoms

• Every kubectl command fails immediately with gke-gcloud-auth-plugin not found.
• Or no Auth Provider found for name "gcp" after upgrading kubectl to 1.26+.
• The error started after upgrading kubectl, Cloud SDK, or moving to a new machine/CI image.

Common Root Causes

1. The plugin binary is not installed

gke-gcloud-auth-plugin is a separate gcloud component / package that was never installed on this host or CI runner.

2. Stale kubeconfig using the removed in-tree gcp provider

The kubeconfig was generated by an old gcloud and still references auth-provider: gcp, which no longer exists in kubectl 1.26+.

3. Plugin installed but not on PATH

Common in CI where the SDK’s bin directory isn’t exported.

How to Diagnose

All read-only.

# Is the plugin present and on PATH?
which gke-gcloud-auth-plugin && gke-gcloud-auth-plugin --version

# Client version (1.26+ is where the in-tree provider was removed)
kubectl version --client --output=yaml | grep -i gitVersion

# Does the kubeconfig still use the removed provider?
kubectl config view --raw -o yaml | grep -A3 "auth-provider" || echo "no legacy auth-provider (good)"

which failing = plugin not installed. A visible auth-provider:\n name: gcp block = stale kubeconfig.

Fixes

Install the plugin:

gcloud components install gke-gcloud-auth-plugin
# apt-based images:
# sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin

Regenerate the kubeconfig so it uses the exec plugin instead of the removed provider (set the env var so gcloud writes the new format):

export USE_GKE_GCLOUD_AUTH_PLUGIN=True
gcloud container clusters get-credentials prod \
  --region=us-central1 --project=acme-prod-platform

Verify:

kubectl get nodes

In CI, install the plugin in the image build and export the SDK bin on PATH so the exec plugin is discoverable at runtime.

What to Watch Out For

• This error is about the tooling, not IAM or RBAC — no permissions changes are needed.
• Always regenerate the kubeconfig after installing the plugin; installing alone won’t fix a config that still says auth-provider: gcp.
• Pin gke-gcloud-auth-plugin into container/CI images alongside kubectl so upgrades don’t break pipelines.
• Once authenticated, if you then see You must be logged in to the server (Unauthorized), that’s a separate token/RBAC issue.

Related

• GCP Error: ‘You must be logged in to the server (Unauthorized)’
• GCP Error: ‘Your cluster’s nodes are unhealthy’
• GCP Error: ‘Reauthentication required’
• More in the GCP error guides.