k8s: use ExecCredential for authentication

[bouk]

This changes the behavior of saving kubeconfig locally to set up an exec plugin in the kubeconfig, which gets called to talk to our API and retrieve credentials to authenticate against the Kubernetes server.

It caches the credentials under ~/.config/doctl/cache/kubeconfig/<uuid>.json

[bouk]

If you want to give it a shot locally, just check out my branch, run go get github.com/digitalocean/doctl/cmd/doctl and then doctl k8s cluster create ... or doctl k8s cluster kubeconfig save ...

Then look at the kubernetes config with kubectl config view

[nanzhong]

Looking through the docs on exec plugins I see:

Alternatively, a PEM-encoded client certificate and key can be returned to use TLS client auth. If the plugin returns a different certificate and key on a subsequent call, k8s.io/client-go will close existing connections with the server to force a new TLS handshake.

Trying to grok my head around what situations client-go will hold onto multiple connections 🤔 and what the implications are for us, since we dogenerate a new cert on each api call.

[bouk]

@fatih I've improved the errors, please take another look

[fatih]

lgtm 👍