Deploy to GKE from CI server outside of cluster
The easiest approach does appear to be to use gcloud, as trying to get a kubeconfig without it proved tricky.

Fortunately, gcloud, kubectl and helm are available as a single docker image kiwigrid/gcloud-kubectl-helm. For example:

docker run -it --rm --volume ./gcp-key-file.json:/data/gcp-key-file.json:ro kiwigrid/gcloud-kubectl-helm:2.11.0-224.0.0 bash
gcloud auth activate-service-account --key-file=/data/gcp-key-file.json
gcloud container clusters get-credentials dev-cluster --project &lt;project name&gt; --zone &lt;zone&gt;