Command to generate kubeconfig for named OIDC resource

[kwiatekus]

Description

Implement a new command that would generate kubeconfig file for a named OIDC configuration.

It would add kyma abstraction on top of functionality that is similar to kubeconfig set-credentials by doing a lookup for oidc config data from named OpenIDConnect.authentication.gardener.cloud/v1alpha1 resource on the cluster instead of requiring all oidc config to be passed by the flags.

kyma alpha kubeconfig  generate --oidc-name {OpenIDConnect resource name} --output kubeconfig-for-oidc.yaml

Reasons

Thanks to gardener's shoot-oidc-service extension, managed kyma clusters are able to persist multiple OIDC configurations as CRs. Add possibility for users to easily generate kubeconfig with user context configred with the name oidc config.

Attachments

[kwiatekus]

Potential follow up:

As it would not be any good to add another case for kubeconfig generate command, I suggest refactoring for better API clarity before moving out from alpha command group.

For example:

kyma kubeconfig generate for-sa  \
      --clusterrole string            Name of the Cluster Role to bind the Service Account to
      --namespace string              Namespace in which the resource is created (default "default")
      --output string                 Path to the kubeconfig file output. If not provided, the kubeconfig will be printed
      --permanent                     Determines if the token is valid indefinitely
      --serviceaccount string         Name of the Service Account to be created
      --time string                   Determines how long the token should be valid, by default 1h (use h for hours and d for days) (default "1h")


kyma kubeconfig generate for-gh  \
      --audience string               Audience of the token
      --id-token-request-url string   URL to request the ID token, defaults to ACTIONS_ID_TOKEN_REQUEST_URL env variable
      --output string                 Path to the kubeconfig file output. If not provided, the kubeconfig will be printed
      --token string                  Token used in the kubeconfig

kyma kubeconfig generate for-oidc  --name {OpenIDConnect resource name}

Verify if for-oidc could cover for-gh case.. Maybe we dont need a separate command for github case as authenticating against github's OIDC service is just a special case for OIDC in general.