Add "tanzu context get-token" command to fetch a valid CSP token for the given context

[prkalle]

What this PR does / why we need it

This PR adds "tanzu context get-token" command to fetch a valid CSP token for the given context

Changes Summary:

• Add a hidden command "tanzu context get-token" to fetch a valid CSP token for the given context. This command would be used in the kubeconfig generated for UCP resource to fetch/refresh the access-token dynamically.
• Updated the kubeconfig generation logic to include the exec plugin to fetch the access token dynamically
• Command would return error if the context provided is not an UCP context

Which issue(s) this PR fixes

Fixes #

Describe testing done for PR

Created the UCP context and ran the tanzu context get-token and it successfully printed the ExecCredentials to stdout.

❯ ./bin/tanzu context list
Target:  kubernetes
  NAME           ISACTIVE  ENDPOINT                                                                         KUBECONFIGPATH                           KUBECONTEXT
  test-withcert  false     https://10.206.208.104:6443                                                      /Users/pkalle/.kube-tanzu/config         tanzu-cli-tkg-mgmt-vc@tkg-mgmt-vc
  tkg-mgmt-vc    false                                                                                      /Users/pkalle/temp/tkgCluster_admin.kfg  tkg-mgmt-vc-admin@tkg-mgmt-vc
  myucp          true      https://api-dev.tanzu.cloud.vmware.com/org/bc27608b-4809-4cac-9e04-778803963da2  /Users/pkalle/.kube/config               tanzu-cli-myucp
Target:  mission-control
  NAME            ISACTIVE  ENDPOINT
  tt-test-selfmg  false     tmc-sm-main.local-dev.7infra.com:443
  mytmc           false     unstable.tmc-dev.cloud.vmware.com:443
  mytmc2          true      unstable.tmc-dev.cloud.vmware.com:443


❯ ./bin/tanzu context get-token myucp
{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1","spec":{"interactive":false},"status":{"expirationTimestamp":"2023-09-27T22:08:24Z","token":"<REDACTED>"}}

Tested with context that is not of UCP type

❯ ./bin/tanzu context get-token tkg-mgmt-vc
[x] : context "tkg-mgmt-vc" is not of type UCP

Created a UCP context and verified the kubeconfig has user information with ExecConfig with reference to tanzu context get-token

❯ ./bin/tanzu context create myucp --endpoint https://api-dev.tanzu.cloud.vmware.com --type application-engine  --staging
[i] API token env var is set

[ok] successfully created a Application Engine(UCP) context



//kubeconfig generated

apiVersion: v1
clusters:
- cluster:
    server: https://api-dev.tanzu.cloud.vmware.com/org/bc27608b-4809-4cac-9e04-778803963da2
  name: tanzu-cli-myucp/current
contexts:
- context:
    cluster: tanzu-cli-myucp/current
    user: tanzu-cli-myucp-user
  name: tanzu-cli-myucp
current-context: ""
kind: Config
preferences: {}
users:
- name: tanzu-cli-myucp-user
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1
      args:
      - context
      - get-token
      - myucp
      command: tanzu
      env: []
      provideClusterInfo: false

Release note

Additional information

Special notes for your reviewer

[vuil]

Might be good to document the behavior when the tanzu cli is found but get-token is not, and when tanzu is not found.

1. this is found during development, when I have the released and build binaries of cli named differently.
   but it would be a potential issue for other customers

~> kubectl api-resources
NAME   SHORTNAMES   APIVERSION   NAMESPACED   KIND
Unable to connect to the server: getting credentials: decoding stdout: yaml: line 3: mapping values are not allowed in this context

2. this is a rarer situation, but could happen if tanzu is somehow not in the user's PATH

~> kubectl api-resources
NAME   SHORTNAMES   APIVERSION   NAMESPACED   KIND
Unable to connect to the server: getting credentials: exec: executable tanzu not found

It looks like you are trying to use a client-go credential plugin that is not installed.

To learn more about this feature, consult the documentation available at:
      https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

Not to block this change, but we might want to take note to see if we can do some validation (by actually test running "tanzu context get-token" or something) before assigning the invocation to the kubeconfig's Exec

[vuil]

Nice! A question about interactive mode, and some thoughts about maybe doing some preflight check about the Exec command.

[prkalle]

Not to block this change, but we might want to take note to see if we can do some validation (by actually test running "tanzu context get-token" or something) before assigning the invocation to the kubeconfig's Exec

Created an Issue#506 to track and address it