Feature Overview

Generate a new kubeconfig for the managed cluster if the ingress or the api certificate is configured.

Goals

The reason is when customer configured the certs, the original kubeconfig will fail with error "x509 signed by unknown authority". It requires, either using --skip-tls-verify=true, to omit the certificate verification, or requires configuration of the local kubeconfig as shown in article - https://access.redhat.com/solutions/7076376.

With automatic regeneration of the kubeconfig with the CA from the api or ingress (usually in the proxy/cluster - .spec.trustedCA) it will remove the obstacle of manually configuring the kubeconfig.

Requirements

It would require 2 kubeconfigs generated, one plain without user, only for developers to use when doing "oc login" and second fully system:admin user kubeconfig, with client certs.