Add a task page for setting up kubeconfig

[sftim]

This is an umbrella issue

What would you like to be added
Add a new task page that explains how to put a kubeconfig in place for accessing a cluster.

Why is this needed
People might set up a PC to authenticate to a cluster that they did not deploy, and would like to learn how.

Comments
We already have:

• a reference page
• a task page for when you want to access more than one cluster

but we don't have a task page for setting up kubeconfig when you just want to access a single cluster.

We should try to merge a basic task page first, but leave this issue open until that task is thorough and covers details such as impersonation, credential plugins, and kuberc (experimental - see https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/3104-introduce-kuberc/README.md).

/sig cli
/language en
/kind feature

[sftim]

Related to #38478

[sftim]

/priority important-longterm
/triage accepted

[mrgiles]

It seems to me that simply adapting the contents of the existing Configure Access to Multiple Clusters page to configure a single cluster would satisfy this requirement.

What is currently missing in the existing document is the pre-requisite to obtaining the necessary existing cluster information from a cluster administrator. Things like the cluster URL and the client SSL certificate or other necessary access credentials.

It would be useful to include links to the kubectl reference documentation, such as:
kubectl [set-cluster|set-context|set-credentials].

And a link to the kubeadmin reference documentation could also be useful: Generating kubeconfig files for additional users.

What do you think @sftim?

[sftim]

It seems to me that simply adapting the contents of the existing Configure Access to Multiple Clusters page to configure a single cluster would satisfy this requirement.

Sounds good to me.

For certificates, we should try to cover real-life workflows (for example: generate a key locally, get a certificate signed, use that) and not only less secure stories such as: a cluster administrator emails you a certificate and private key.
Replace “emails” with Teams or Slack and it's the same problem. There is a more secure option and we should avoid implying that the bad way is what you do.
It'd be nice to cover credential plugins, too. Those are another good way to set up actually-secure API access.

We can mention that various Kubernetes components also load kubeconfig files.

There are two lots of kubectl documentation; see #25943
Feel free to borrow from either.

[sftim]

/help

[k8s-ci-robot]

@sftim:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mariasalcedo]

Is this still required? If so, can I assign myself to this issue?

[network-charles]

Hi @mariasalcedo, since it's not closed yet, I believe you can.

[mariasalcedo]

/assign

[lmktfy]

(this is still useful to work on)

[soltysh]

@lmktfy do you want to expand this task to cover both kubeconfig and kuberc? Or should we open separate issue to track the latter?

[lmktfy]

@lmktfy do you want to expand this task to cover both kubeconfig and kuberc? Or should we open separate issue to track the latter?

The task page for writing a kubeconfig should mention that kuberc is a thing and link to the docs about writing a kuberc.

---

We should (my opinion) have a new separate issue similar to this one, about writing a kuberc.

The task page for writing a kuberc should prominently hyperlink to the docs about writing a kubeconfig, so that people don't write a kuberc and then wonder why they can't run kubectl get pod.

PR #50913 goes a long way towards covering the outcome of that separate issue.

[soltysh]

Opened #50988 to track it.