feat(deployer): authenticate to GKE via WIF and generate scoped kubeconfig

[Syphon83]

Summary

Adds GKE kubeconfig generation support to the deployer by introducing a new
portable GitLab CI template templates/functions/gke-kubeconfig.yml
(.gke-kubeconfig) that generates a namespace-scoped kubeconfig for GKE
clusters. It works with any gcloud authentication method (WIF, service account
key, etc.) and acts as an alternative to the GitLab Agent approach.

What changes

• New template templates/functions/gke-kubeconfig.yml — self-contained,
  remotely includable, no Docker image dependency. Defines check_gcloud_auth(),
  check_gke_env() and generate_gke_kubeconfig() inline in before_script.
  Activated when K8S_CLUSTER_NAME is set.
• check_gcloud_auth() — verifies gcloud is available and has an active
  authenticated account before attempting cluster access. Fails with a clear
  message if not authenticated.
• Execution order — .gke-kubeconfig runs as the last step in
  .global-setup, after setup-gitlab-agent, so the gcloud context always
  overrides the agent context when both are configured (safety net for users who
  forget DISABLE_GITLAB_AGENT=1).
• templates/.gitlab-ci-template.yml — new include: entry for
  gke-kubeconfig.yml + !reference added as last step in .global-setup before_script.
• scripts/src/functions.bash — removed legacy kubectl config set-cluster/set-credentials/set-context/use-context commands referencing the
  old gitlab-deploy context.
• DNS endpoint support — K8S_USE_DNS_ENDPOINT=1 conditionally passes
  --dns-endpoint to gcloud container clusters get-credentials for private
  GKE clusters.
• Namespace scoping — kubeconfig context is scoped to $KUBE_NAMESPACE via
  kubectl config set-context --current --namespace.

Variables consumed

All injected by the platform generator (board#4348):

Variable	Description
K8S_CLUSTER_NAME	GKE cluster name — activates the template when set
K8S_LOCATION	GKE cluster location
GCP_PROJECT_ID	GCP project ID
KUBE_NAMESPACE	Target namespace
K8S_USE_DNS_ENDPOINT	"1" to pass --dns-endpoint for private clusters

Backward compatibility

Pipelines without K8S_CLUSTER_NAME are completely unaffected — the template
emits a skip message and exits cleanly. The template is auth-method agnostic:
it works with WIF (gcp-wif.yml), a service account key, or any other gcloud
authentication configured before it runs.

[paolomainardi]

/describe

[Copilot]

Pull request overview

This PR adds a new Kubernetes authentication path for GitLab CI pipelines targeting GKE: when Workload Identity Federation (WIF) is enabled, the deployer can authenticate via gcloud and generate a namespace-defaulted kubeconfig, while preserving the legacy static-token path.

Changes:

• Extend create_kubeconfig() / ensure_deploy_variables() to support a WIF+GKE execution branch driven by ENABLE_GCP_WIF=1 and K8S_CLUSTER_NAME.
• Wire WIF+GKE kubeconfig generation into the shared GitLab CI before_script after GitLab Agent setup.
• Document the new authentication mode and variables (README + changelog) and add OpenSpec workflow artifacts/commands.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
templates/.gitlab-ci-template.yml	Adds a gated create_kubeconfig call in before_script for WIF+GKE pipelines.
scripts/src/functions.bash	Implements WIF+GKE kubeconfig creation via gcloud get-credentials and adjusts variable validation logic.
README.md	Documents legacy token auth vs WIF+GKE variables/behavior and ordering with GitLab Agent.
CHANGELOG.md	Adds unreleased entries describing the new WIF+GKE kubeconfig and validation behavior.
openspec/config.yaml	Adds OpenSpec configuration scaffold for spec-driven workflow.
openspec/changes/wif-gke-kubeconfig/.openspec.yaml	Adds OpenSpec change metadata.
openspec/changes/wif-gke-kubeconfig/proposal.md	Captures the “why/what” for WIF+GKE kubeconfig support.
openspec/changes/wif-gke-kubeconfig/design.md	Captures design decisions, execution order, and risks/trade-offs.
openspec/changes/wif-gke-kubeconfig/tasks.md	Tracks implementation tasks and validation checklist for the change.
openspec/changes/wif-gke-kubeconfig/specs/wif-gke-kubeconfig/spec.md	Adds delta spec describing WIF+GKE kubeconfig requirements.
openspec/changes/wif-gke-kubeconfig/specs/kubeconfig-creation/spec.md	Adds delta spec describing multi-path kubeconfig creation + validation requirements.
.opencode/skills/openspec-propose/SKILL.md	Adds OpenSpec “propose” skill definition for OpenCode workflow.
.opencode/skills/openspec-explore/SKILL.md	Adds OpenSpec “explore” skill definition for OpenCode workflow.
.opencode/skills/openspec-archive-change/SKILL.md	Adds OpenSpec “archive change” skill definition for OpenCode workflow.
.opencode/skills/openspec-apply-change/SKILL.md	Adds OpenSpec “apply change” skill definition for OpenCode workflow.
.opencode/command/opsx-propose.md	Adds /opsx-propose command documentation for OpenCode workflow.
.opencode/command/opsx-explore.md	Adds /opsx-explore command documentation for OpenCode workflow.
.opencode/command/opsx-archive.md	Adds /opsx-archive command documentation for OpenCode workflow.
.opencode/command/opsx-apply.md	Adds /opsx-apply command documentation for OpenCode workflow.
.github/skills/openspec-propose/SKILL.md	Adds OpenSpec “propose” skill definition for GitHub workflow.
.github/skills/openspec-explore/SKILL.md	Adds OpenSpec “explore” skill definition for GitHub workflow.
.github/skills/openspec-archive-change/SKILL.md	Adds OpenSpec “archive change” skill definition for GitHub workflow.
.github/skills/openspec-apply-change/SKILL.md	Adds OpenSpec “apply change” skill definition for GitHub workflow.
.github/prompts/opsx-propose.prompt.md	Adds /opsx:propose prompt content for GitHub workflow.
.github/prompts/opsx-explore.prompt.md	Adds /opsx:explore prompt content for GitHub workflow.
.github/prompts/opsx-archive.prompt.md	Adds /opsx:archive prompt content for GitHub workflow.
.github/prompts/opsx-apply.prompt.md	Adds /opsx:apply prompt content for GitHub workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[paolomainardi]

@copilot can you add a description of what the PR does ? update the PR description

[Copilot]

@copilot can you add a description of what the PR does ? update the PR description

I've updated the PR description with a full summary of the changes: what problem is being solved, what files changed and why, how activation works, the variables table, and backward compatibility notes.

[Monska85]

I would also use the approach used for the WIF bash functions: all the needed functions are defined in the YAML templates. This allow the portability of these functions simply using the templates and decoupling the bash functions from the spark-k8s-deployer docker image. A bash shell is the only requirement.

@Stevesibilia you can help with this task.

[Syphon83]

I would also use the approach used for the WIF bash functions: all the needed functions are defined in the YAML templates. This allow the portability of these functions simply using the templates and decoupling the bash functions from the spark-k8s-deployer docker image. A bash shell is the only requirement.

@Stevesibilia you can help with this task.

I reverted the changes done in the bash scripts and created a new template called gke-kubeconfig.
Template should tun after gitlab agent setup in order to override it just in case.
I removed the old configuration involving gitlab-deploy.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.