I had a few breaking changes in the past with using the gcloud tool to authenticate kubectl to a cluster, so I ended up figuring out how to auth kubectl to a specific namespace independent of GKE. Here's what works for me:

On CircleCI:

setup_kubectl() {
echo "$KUBE_CA_PEM" | base64 --decode > kube_ca.pem
kubectl config set-cluster default-cluster --server=$KUBE_URL --certificate-authority="$(pwd)/kube_ca.pem"
kubectl config set-credentials default-admin --token=$KUBE_TOKEN
kubectl config set-context default-system --cluster=default-cluster --user=default-admin --namespace default
kubectl config use-context default-system
}

And here's how I get each of those env vars from kubectl.

kubectl get serviceaccounts $namespace -o json

The service account will contain the name of it's secret. In my case, with the default namespace, it's

"secrets": [
    {
        "name": "default-token-655ls"
    }
] 

Using the name, I get the contents of the secret

kubectl get secrets $secret_name -o json

The secret will contain ca.crt and token fields, which match the $KUBE_CA_PEM and $KUBE_TOKEN in the shell script above.

Finally, use kubectl cluster-info to get the $KUBE_URL value.

Once you run setup_kubectl on CI, your kubectl utility will be authenticated to the namespace you're deploying to.