[Max Thompson (thompsonmax)]

Part of #1464

Support ExecCredential kubectl ate authentication.

• --credential-plugin (or $ATE_CREDENTIAL_PLUGIN) names a kubectl credential plugin: a path to an executable, or a command line. kubectl ate passes the plugin its --kubeconfig and --context as $ATE_KUBECONFIG and $ATE_KUBE_CONTEXT.
• internal/ateclient caches the plugin's credential until it expires and retries an RPC once on UNAUTHENTICATED. If the plugin returns the rejected token again from its own cache, the client reruns it with ATE_REFRESH_CREDENTIAL=1. The default ServiceAccount token now refreshes too, which fixes [P1] ateclient mints a single 1-hour bearer token and never refreshes it — long-lived clients go permanently Unauthenticated #644.
• kubectl ate credential mints and disk-caches ServiceAccount tokens (the shared ate-client, or one named with --service-account) and wraps any command that prints a JWT.
• kubectl ate whoami calls a new Authentication.WhoAmI RPC so users can check which principal ate-api sees.

Here's how each authentication option looks after this change:

--token-file: you supply the token yourself (Already existed before this change)

kubectl ate sends whatever token the file holds. It re-reads the file on every RPC, so a rotated file is picked up automatically, but it never runs anything to get a new token.

# A token you minted yourself
kubectl create token alice -n ate-users --audience=api.ate-system.svc > /tmp/alice.token
kubectl ate --token-file=/tmp/alice.token whoami

# A token piped through stdin, used for this one command
gcloud auth print-identity-token | kubectl ate --token-file=- get actors

# An in-cluster pod using its projected ServiceAccount token (the kubelet rotates the file)
kubectl ate --endpoint=api.ate-system.svc:443 \
  --token-file=/var/run/secrets/ate/token get actors

--credential-plugin: kubectl ate runs a command that produces the credential (What we're introducing here)

The command must print an ExecCredential (v1) as JSON. kubectl ate caches the credential until its expirationTimestamp, and runs the command again when the credential expires or ate-api rejects it.

# Built-in plugin, acting as a per-user ServiceAccount
kubectl ate --credential-plugin="kubectl-ate credential --service-account=ate-users/alice" whoami

# Same thing, set once for the whole shell session
export ATE_CREDENTIAL_PLUGIN="kubectl-ate credential --service-account=ate-users/alice"
kubectl ate get actors -a alice-space

# A standalone plugin binary; a path that exists runs as-is, with no arguments
kubectl ate --credential-plugin=/usr/local/bin/my-auth-plugin whoami

# Wrapping a tool that prints a raw JWT
kubectl ate --credential-plugin="kubectl-ate credential wrap -- gcloud auth print-identity-token" whoami

# Corporate OIDC through kubelogin
kubectl ate --credential-plugin="kubectl oidc-login get-token --oidc-issuer-url=https://idp.example.com --oidc-client-id=substrate" whoami

# Kube flags are passed to the plugin as ATE_KUBECONFIG and ATE_KUBE_CONTEXT
kubectl ate --context=prod --credential-plugin="kubectl-ate credential --service-account=ate-users/alice" get actors

Rules that apply to both

• Precedence: --token-file comes first, then --credential-plugin or $ATE_CREDENTIAL_PLUGIN, then the shared ate-client token, which prints a warning.
• Both flags: passing --token-file and --credential-plugin together is an error. --token-file with only $ATE_CREDENTIAL_PLUGIN set uses the token file.
• Parsing a plugin value: a path to an existing file runs with no arguments. Anything else is split shell-style, and quotes work as they would in a shell: --credential-plugin="my-sso print-token --scope 'ate api'".

Reviewer notes: WhoAmI is a separate service because apitool requires every Control method to name a resource. The exec stanza is fixed at client.authentication.k8s.io/v1, so plugins that only answer v1beta1 fail. Passing both --token-file and --credential-plugin is an error.

Testing: unit tests; e2e checks WhoAmI with a token file and with a credential plugin (cat of an ExecCredential).

Fixes #644

• Tests pass
• Appropriate changes to documentation are included in the PR

[Dmitry Berkovich (dberkov)]

🤖 nit 🟢 – When re-minting fails inside the one-minute margin, the RPC fails even though the cached token is still valid. Consider returning the current token while now < expiry and only surfacing the mint error once it has actually expired, so a transient TokenRequest failure does not take down a long-lived client early.

[Dmitry Berkovich (dberkov)]

🤖 nit 🟢 – With --kubeconfig and --context unset, this key does not distinguish different $KUBECONFIG values or a changed current-context that resolve to the same config.Host, which is the case the comment above is guarding against. Keying on the resolved context name and its AuthInfo name from RawConfig() would tie the entry to the minting identity rather than to the paths.

[Dmitry Berkovich (dberkov)]

nit: in some places it says "kubectl ate credential" in others "kubectl-ate credential".