I already found the way using gcloud CLI.

gcloud auth activate-service-account --key-file=serviceaccount.json
gcloud container clusters get-credentials $clusterName \
    --zone=$zone --project=$project
kubectl config view --minify --flatten

However, to eliminate dependency to gcloud cli, Is there any programmatic way to achieve a similar result as above? Preferably using API exposed in Google's python client library.

My expected result is a portable config file that can be passed to any kubectl --kubeconfig=... command.

update: I have found that the commands I showed above results in a kube config file that still depends on gcloud cli as auth helper, probably to automatically handle token expiration. So, any workarounds are welcome.