These errors also depend on the overall situation of the project. Compute Engine service account manages lots of services, so upon deleting it, the errors come in different flavours.

When I get my SA deleted, I always do the same thing, as first step. Instead of going ahead and creating the service account manually, I enable an API that needs Compute Engine API, like Dataproc API. This should re-create Compute Engine service account, and in this case, as it is relevant, it also re-created Kubernetes Engine service account.

Once these accounts re-created, you should have different errors, as now the SA is there, but probably the token/credentials the cluster expects is the old one, but now you are passing a new token.

Can you confirm doing this you get the same errors or different? I'll edit the post once I get this info.

Your service account lost roles after you re-created it.

First, use gcloud auth login and log into GCE account.

After the new service account is created, the role is required to be assigned to it.

In this case, the "roles/compute.admin" role is missed and needs to be reassigned. I assume that you know the name of the service account you created.

It may help:

gcloud projects add-iam-policy-binding  project-id \
    --member serviceAccount:service-account@project-id.iam.gserviceaccount.com \
    --role  roles/compute.admin

It is described at AIM roles documentation.

EDITED: I found that is a another way to fix it:

gcloud service-management enable container.googleapis.com