feat: Starting with 1.30, do not use the cluster OIDC issuer URL by default in the identity provider config

[bryantbiggs]

Description

• Starting with 1.30, do not use the cluster OIDC issuer URL by default in the identity provider config
• The example referenced in the v19 upgrade doc has been corrected to better reflect the intended behavior enforced by this change

Motivation and Context

• Starting in Kubernetes 1.30, there are improved restrictions on authentication. From Prevent conflicts between service account and jwt issuers kubernetes/kubernetes#123561:

Conflicting issuers between JWT authenticators and service account config are now detected and fail on API server startup. Previously such a config would run but would be inconsistently effective depending on the credential.

The prior default value of the cluster (control plane) OIDC issuer URL was incorrect and should not be used in this context. Users should provider their issuer's URL for their identity provider (i.e. - Cognito, Okta, Auth0, etc.). Therefore, this change is aligning with the upstream Kubernetes project to ensure users provide the correct issuer URL when associating additional identity providers to their cluster

Breaking Changes

• Yes'ish - it requires users to potentially make changes if they are currently, and incorrectly, utilizing the cluster's OIDC issuer url. But, if they don't, the API server will reject this and fail

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)

• I have tested and validated these changes using one or more of the provided examples/* projects

  1. Created a cluster on 1.29 with the following config:

     ...
     cluster_identity_providers = {
       example = {
         client_id  = "1234567890abc"
       }
     }
     ...

  2. Once the cluster has provisioned, change the Kubernetes version to 1.30 and execute:

   terraform plan

  3. From the plan, the following error is now shown to users:
     
  4. To resolve, users will need to explicitly provide the *correct issuer URL (if you incorrectly re-provide the cluster's OIDC issuer URL, the API server will fail). For example, continuing the example above, updating the configuration to something like this now plans successfully (these are contrived values, but they demonstrate the intended behavior of the change):

     ...
     cluster_identity_providers = {
       example = {
         client_id  = "1234567890abc"
         issuer_url = "https://myissuer.com"
       }
     }
     ...

• I have executed pre-commit run -a on my pull request

[antonbabenko]

This PR is included in version 20.13.0 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.