Allow admins to easily use a viewer kubeconfig by default

[maboehm]

How to categorize this topic?

/area security
/area ops-productivity
/kind enhancement

/label teamsize/small

What is the topic about?:
Using gardenctl, a admin always gets a adminkubeconfig when connecting to shoots or seeds. It would be great, if I can configure in my gardenctl something like this:

gardens:
- name: prd
  kubeconfig: /secret/path
  config:
    useViewerKubeconfig: always|shoots|managedseeds|never

And then also introduce a flag like --admin or --viewer to overwrite this for any gardenctl target command.

[jamand]

Status

Added the following config fields:

gardens:
- identity: prd-garden
  kubeconfig: ~/path/to/kubeconfig.yaml
  defaultKubeconfigAccessLevel:
    shoots: viewer        # admin (default) | viewer | auto
    managedSeeds: admin   # admin (default) | viewer | auto

Implemented the feature. Added a bit of convenience like configuration through gardenctl config set-garden and automatic refreshing of the symlinked kubeconfig in case the set-garden command was used to modify the access level of the current garden (to avoid confusion).

Open PR

gardener/gardenctl-v2#735

[jamand]

/assign jamand