Gardener: Generate OIDC kubeconfig when OIDC is specified

[mvladev]

What would you like to be added:

When OIDC is specified in the Shoot cluster, a OIDC kubeconfig should be generated. Given:

apiVersion: garden.sapcloud.io/v1beta1
kind: Shoot
metadata:
  name: preset
  namespace: default
  labels:
    oidc: enabled
spec:
  kubernetes:
    kubeAPIServer:
      oidcConfig:
        clientAuthentication:
          extraConfig:
            extra-scopes: email,offline_access,profile
            foo: bar
          secret: oidc-client-secret
        clientID: cluster-preset
        groupsClaim: groups-claim
        groupsPrefix: groups-prefix
        issuerURL: https://auth.foo.bar
        requiredClaims:
          key: value
        signingAlgs:
        - RS256
        usernameClaim: username-claim
        usernamePrefix: username-prefix
    version: 1.15.2
  dns:
    domain: foo.bar

it should produce the following kubeconfig

apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://api.foo.bar:443
  name: shoot--default--preset
contexts:
- context:
    cluster: shoot--default--preset
    user: shoot--default--preset
  name: shoot--default--preset
current-context: shoot--default--preset
users:
- name: shoot--default--preset
  user:
    auth-provider:
      name: oidc
      config:
        client-id:  cluster-preset
        cliient-secret: oidc-client-secret
        idp-issuer-url: https://auth.foo.bar
        extra-scopes: email,offline_access,profile
        foo: bar

This have a requirement to #1394

[rfranzke]

@mvladev what's the plan here?

[mvladev]

We still need the {{shoot-name}}.kubeconfig as it's used by admins to grant privileges to the end-users.

The plan is the following:

• If OIDC is enabled add additional context and user to the existing {{shoot-name}}.kubeconfig with a prefix -oidc:

  apiVersion: v1
  kind: Config
  clusters:
  - cluster:
    server: https://api.foo.bar:443
  name: shoot--default--preset
  contexts:
  - name: shoot--default--preset
  context:
    cluster: shoot--default--preset
    user: shoot--default--preset
  - name: shoot--default--preset-oidc
  context:
    cluster: shoot--default--preset
    user: shoot--default--preset-oidc
  current-context: shoot--default--preset
  users:
  - name: shoot--default--preset
  user:
    client-certificate-data: abcd1234
    client-key-data: abcd1234
  - name: shoot--default--preset-basic-auth
  user:
    username: admin
    password: abcd1234
  - name: shoot--default--preset-oidc
  user:
    auth-provider:
      name: oidc
      config:
        client-id:  cluster-preset
        cliient-secret: oidc-client-secret
        idp-issuer-url: https://auth.foo.bar
        extra-scopes: email,offline_access,profile
        foo: bar
  

• if OIDC is enabled, then a {{shoot-name}}.oidc-kubeconfig secret is created containing:

  apiVersion: v1
  kind: Config
  clusters:
  - cluster:
    server: https://api.foo.bar:443
  name: shoot--default--preset
  contexts:
  - context:
    cluster: shoot--default--preset
    user: shoot--default--preset
  name: shoot--default--preset
  current-context: shoot--default--preset
  users:
  - name: shoot--default--preset
  user:
    auth-provider:
      name: oidc
      config:
        client-id:  cluster-preset
        cliient-secret: oidc-client-secret
        idp-issuer-url: https://auth.foo.bar
        extra-scopes: email,offline_access,profile
        foo: bar
  

• this additional secret is then copied to the gardener cluster by SyncShootCredentialsToGarden function.

I think that it should be sufficient?

[rfranzke]

/touch