fix(ske): prefer explicit login configuration

Author: Galin-Karabadzhakov

internal/cmd/ske/kubeconfig/login/login.go

@@ -24,7 +24,6 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 
 	sdkAuth "github.com/stackitcloud/stackit-sdk-go/core/auth"
-	"github.com/stackitcloud/stackit-sdk-go/core/clients"
 	sdkConfig "github.com/stackitcloud/stackit-sdk-go/core/config"
 	ske "github.com/stackitcloud/stackit-sdk-go/services/ske/v2api"
 
@@ -49,9 +48,8 @@ const (
 	clusterNameFlag  = "cluster-name"
 	organizationFlag = "organization-id"
 
-	envAccessToken            = "STACKIT_ACCESS_TOKEN"
-	envServiceAccountEmail    = "STACKIT_SERVICE_ACCOUNT_EMAIL"
-	defaultFederatedTokenPath = "/var/run/secrets/stackit.cloud/serviceaccount/token" //nolint:gosec // Public path, not a credential.
+	envAccessToken         = "STACKIT_ACCESS_TOKEN"
+	envServiceAccountEmail = "STACKIT_SERVICE_ACCOUNT_EMAIL"
 )
 
 func NewCmd(params *types.CmdParams) *cobra.Command {
@@ -190,17 +188,17 @@ func parseClusterConfig(p *print.Printer, cmd *cobra.Command, idpMode, workloadI
 		}
 	}
 
-	if clusterConfig.ClusterName == "" {
-		clusterConfig.ClusterName = flags.FlagToStringValue(p, cmd, clusterNameFlag)
+	if clusterName := flags.FlagToStringValue(p, cmd, clusterNameFlag); clusterName != "" {
+		clusterConfig.ClusterName = clusterName
 	}
-	if clusterConfig.OrganizationID == "" {
-		clusterConfig.OrganizationID = flags.FlagToStringValue(p, cmd, organizationFlag)
+	if organizationID := flags.FlagToStringValue(p, cmd, organizationFlag); organizationID != "" {
+		clusterConfig.OrganizationID = organizationID
 	}
 	globalFlags := globalflags.Parse(p, cmd)
-	if clusterConfig.STACKITProjectID == "" {
+	if globalFlags.ProjectId != "" {
 		clusterConfig.STACKITProjectID = globalFlags.ProjectId
 	}
-	if clusterConfig.Region == "" {
+	if globalFlags.Region != "" {
 		clusterConfig.Region = globalFlags.Region
 	}
 
@@ -444,11 +442,11 @@ func workloadIdentityConfigured() bool {
 	if os.Getenv(envServiceAccountEmail) == "" {
 		return false
 	}
-    if auth.IsOIDCEnabled() {
-        return true
-    }
-    _, err := auth.OIDCTokenFunc()
-    return err == nil
+	if auth.IsOIDCEnabled() {
+		return true
+	}
+	_, err := auth.OIDCTokenFunc()
+	return err == nil
 }
 
 func getWorkloadIdentityAccessToken() (string, error) {

internal/cmd/ske/kubeconfig/login/login_test.go

@@ -112,11 +112,15 @@ func TestParseClusterConfigWithoutExecClusterInfo(t *testing.T) {
 	}
 }
 
-func TestParseClusterConfigUsesExecClusterInfo(t *testing.T) {
+func TestParseClusterConfigPrefersExplicitConfiguration(t *testing.T) {
 	viper.Reset()
 	t.Cleanup(viper.Reset)
-	viper.Set(config.ProjectIdKey, uuid.NewString())
-	viper.Set(config.RegionKey, "conflicting-region")
+	explicitProjectID := uuid.NewString()
+	explicitRegion := "explicit-region"
+	explicitClusterName := "explicit-cluster"
+	explicitOrganizationID := uuid.NewString()
+	viper.Set(config.ProjectIdKey, explicitProjectID)
+	viper.Set(config.RegionKey, explicitRegion)
 	t.Setenv(envServiceAccountEmail, "workload@sa.stackit.cloud")
 
 	configJSON, err := json.Marshal(fixtureClusterConfig())
@@ -131,16 +135,48 @@ func TestParseClusterConfigUsesExecClusterInfo(t *testing.T) {
 	params := testparams.NewTestParams()
 	cmd := &cobra.Command{}
 	configureFlags(cmd)
-	if err := cmd.Flags().Set(clusterNameFlag, "conflicting-cluster"); err != nil {
+	if err := cmd.Flags().Set(clusterNameFlag, explicitClusterName); err != nil {
 		t.Fatalf("set cluster name flag: %v", err)
 	}
-	if err := cmd.Flags().Set(organizationFlag, uuid.NewString()); err != nil {
+	if err := cmd.Flags().Set(organizationFlag, explicitOrganizationID); err != nil {
 		t.Fatalf("set organization flag: %v", err)
 	}
 	actual, err := parseClusterConfig(params.Printer, cmd, true, true, true)
 	if err != nil {
 		t.Fatalf("parse cluster config: %v", err)
 	}
+	expected := fixtureClusterConfig(func(config *clusterConfig) {
+		config.STACKITProjectID = explicitProjectID
+		config.Region = explicitRegion
+		config.ClusterName = explicitClusterName
+		config.OrganizationID = explicitOrganizationID
+	})
+	if diff := cmp.Diff(actual, expected, cmpopts.IgnoreFields(clusterConfig{}, "cacheKey")); diff != "" {
+		t.Fatalf("Data does not match: %s", diff)
+	}
+}
+
+func TestParseClusterConfigUsesExecClusterInfoAsFallback(t *testing.T) {
+	viper.Reset()
+	t.Cleanup(viper.Reset)
+	t.Setenv(envServiceAccountEmail, "workload@sa.stackit.cloud")
+
+	configJSON, err := json.Marshal(fixtureClusterConfig())
+	if err != nil {
+		t.Fatalf("marshal cluster config: %v", err)
+	}
+	setExecCredentialEnv(t, &clientauthenticationv1.Cluster{
+		Server: "https://api.example.stackit.cloud",
+		Config: runtime.RawExtension{Raw: configJSON},
+	})
+
+	params := testparams.NewTestParams()
+	cmd := &cobra.Command{}
+	configureFlags(cmd)
+	actual, err := parseClusterConfig(params.Printer, cmd, true, true, true)
+	if err != nil {
+		t.Fatalf("parse cluster config: %v", err)
+	}
 	expected := fixtureClusterConfig()
 	if diff := cmp.Diff(actual, expected, cmpopts.IgnoreFields(clusterConfig{}, "cacheKey")); diff != "" {
 		t.Fatalf("Data does not match: %s", diff)