Generating Kubeconfig with custom O and CN fields

[prometherion]

Distributing the admin Kubeconfig to Tenant Control Plane users could be non-feasible in certain security circumstances.

This feature request aims to introduce a new Custom Resource Definition that generates custom Kubeconfig files backed by certificates, with the ability to customise the Organisation (O) as well as the Common Name (CN) fields.

apiVersion: kamaji.clastix.io/v1alpha1
kind: KubeconfigGenerator  # ClusterScoped resource
metadata:
  name: tenant-user
spec:
  namespaceSelector:  # Filter the Namespaces where the TenantControlPlane objects should be extracted
    matchLabels:
      provider.tld/tenant: bar
      matchExpressions: {}
  tenantControlPlaneSelector:  # Select the TenantControlPlane objects the controller should 
    matchLabels:
      provider.tld/tenant: bar
      # or, match by expression
      matchExpressions: {}
  groups:  # X.509 organisations, recognised by Kubernetes as groups
  - stringValue: projectcapsule.dev
  - fromDefinition: "metadata.name"  # retrieve from Tenant Control Plane definition
  user:
    stringValue: alice  # X.509 Common Name
    # or, retrieve from Tenant Control Plane definition
    fromDefinition: metadata.name
  controlPlaneEndpointFrom: admin.svc  # Extract the Control Plane server from the ${TenantControlPlane.metadata.name}-admin-kubeconfig
status:
  resources: 10  # Sum of targeted TenantControlPlane objects
  availableResources: 9  # Sum of successfully generated resources
  errors:
  - resource: namespaced/name
    message: Something went wrong generating the Kubeconfig

Although open to talk, we plan to provide a toolkit to generate a set of kubeconfig for multiple Tenant Control Plane resources. Generated kubeconfig will be available in the same TenantControlPlane Namespace as a Secret with a name formatted as ${TenantControlPlane.metadata.name}-${KubeconfigGenerator.metadata.name}

[prometherion]

Implemented via #933.