Download kubeconfig here - ui design

[LutzLange]

WGE release:

• 0.9.0-rc3

"Download the kubeconfig here" is not maked as a link. Links are usually blue. Also think about moving to something shorter "Download kubeconfig" or some download icon and kubeconfig might be good.

[kingdonb]

In 0.14.2 weave-gitops-enterprise this UI issue does appear to be resolved;

However... after having gone to some trouble to set up kubelogin and provision the cluster for direct access via Dex's OIDC and GitHub Groups, I find that download kubeconfig button itself undesirable, (it circumvents my provisioned access controls)

I want to disable it. Is there any mechanism to disable that? What authorization structure does it use?

I removed the ClusterRoleBinding to the oidc group that I had been granted access to the cluster via, and my downloaded kubeconfig kept on working. This Kubeconfig download feature seems a bit risky on the balance, I don't find it mentioned in any public docs, and a search for "kubeconfig" in the docs comes up empty.

Is there the possibility to disable this feature from the UI at an administrative level?

[kingdonb]

I've been educated to know that Kubeconfig is accessible to my user via RBAC, so it's presented as an option for download. If I don't want users to have access to that Kubeconfig, I need to arrange for that by setting up RBAC rules to be more restrictive.

I've been further educated about the user kubeconfig which is a feature in some CAPI providers, or at least in CAPA, that provides two kubeconfigs – one is for users, already OIDC-enabled with some exec plugin for auth, and the other is the secret bearer token that CAPA uses for CAPI operations when it needs access to the clusters. That one has a 10 minute ttl before it expires, so if it is exfiltrated or copied out of the cluster by mistake, the damage that it can cause will be limited.

I wonder how many CAPI providers really facilitate this – probably more than just CAPA. But it's not an option in my case, I'm using https://github.com/loft-sh/cluster-api-provider-vcluster which does not appear to have that feature.

So now I'm trying to understand two more things:

1. how do I configure restrictive rbac rules so users can get *-user-kubeconfig but not *-kubeconfig secrets? (I'm assuming that is not a valid configuration, and I'd only be able to filter by specific names, or use a wildcard which will be totally unrestricted, but I can not write an RBAC rule that mixes those like *-user-kubeconfig)
2. how do I ensure that the Kubelogin-ready kubeconfig I want users to get (since I've configured Dex + kubelogin) is the one they see presented in the Weave GitOps dashboard when they visit the Cluster they created? (I mean, can I detect the creation of a kubeconfig, extract some certificate authority data out of it, and replace the rest of the body with my own content somehow, to fabricate a user kubeconfig of my own design?)