feat: add the renew kubeconfigs command

[ralgozino]

Summary 💡

Add furyctl renew kubeconfigs command. It renews the kubeconfig file of the admin and the kubeconfig files of the users in spec.kubernetes.advanced.users.names using new Ansible playbooks from the Distribution.

Closes: #575

Relates: sighupio/distribution#588

Description 📝

furyctl renew kubeconfigs                 # all of them
furyctl renew kubeconfigs admin alice     # only these two

The command writes the renewed files to the current directory, with the names that furyctl apply uses: kubeconfig for the admin and <user>.kubeconfig for each user.

Refactor in the same PR. CertificatesRenewer became Renewer, which has RenewCertificates() and RenewKubeconfigs(users). One registry and one implementation for each kind serve both operations, and a private render method holds the template rendering that the two operations share. This removes a second parallel factory registry and about 90 duplicated lines for each kind. The behavior of renew certificates does not change. cmd/renew/renew.go now holds the bootstrap that the two subcommands share.

Cluster kinds. OnPremises and Immutable renew the kubeconfig files. EKSCluster and KFDDistribution give renew is not supported for the <kind> kind, from one shared UnsupportedRenewer.

Some notes for the reviewers:

• Issue Feature request: subcommand furyctl renew kubeconfigs #575 asked for a comma separated list. The command takes a space separated list, which is the usual form for a CLI, and accepts commas too.
• Issue Feature request: subcommand furyctl renew kubeconfigs #575 asked for a secrets/users subdirectory. The files go to the working directory instead, where furyctl apply already writes them, thus a renew overwrites the files that the administrator already has.
• RunPlaybook looks for the playbook before it calls ansible. An older SD then gives the message:

the distribution does not have this playbook: SD v1.35.1 does not have "renew-kubeconfigs.yaml". Upgrade the distribution to a version that has it

Breaking Changes 💔

None. renew certificates keeps its behavior, its flags, and its output.

Tests performed 🧪

• Immutable cluster: no argument renews all the kubeconfig files
• Immutable cluster: one name renews only that kubeconfig file
• Immutable cluster: two names renew only those kubeconfig files, in the space form and in the comma form
• Immutable cluster: an unknown name gives an error that lists the defined users
• Immutable cluster: a user that I added to the configuration file gets a kubeconfig file, and the kubernetes phase is not applied
• The downloaded kubeconfig files work with kubectl --kubeconfig
• Test with an OnPremises cluster

Future work 🔧

docs/furyctl/cli-reference/renew/ in the docs repo needs a furyctl dump cli-reference regen, for furyctl_renew_kubeconfigs.md and the reworded certificates help.

The kubeconfig tasks are duplicated between this playbook and the kube-control-plane role. Moving them into the role needs the renew path to vendor (download) the installers for OnPremises and to render outside a temporary directory, because roles_path is relative. It is worth doing when a third operation needs the same tasks.

Self-assessment checklist 🏁

Important

Make sure that you completed this checklist before asking for review.

PRs that do not have this checklist ready won't be reviewed.

• My PR has a clear scope and does not mix together several unrelated changes
• I've updated the docs/releases/unreleased.md file (or equivalent)
• I've tested the proposed changes and wrote the tests performed in the section above
• My branch is up-to-date with the target branch and there are no conflicts
• I've considered all the different cluster kinds (KFDDistribution, OnPremises, EKSCluster, Immutable) that may be affected by this change
• CI is green