OpenShift kubeconfig generation script.

Add a script to assist in the generation of kubeconfig
for the service accounts to be use with trigger_konflux_pipeline
phase.

Related Jira issue: RHELCMP-14779

Signed-off-by: guillermodotn <gleiro@redhat.com>

contrib/oc-config4konflux/README.md

@@ -0,0 +1,14 @@
+This script helps with the creation of Kubeconfigs files to use with `Trigger Konflux Phase` in Pungi.
+
+> The generated `.kubeconfig` will not overwrite your user level one.
+
+How to use it:
+
+1. First you must create and setup a service account with the desired permission in the OpenShift cluster.
+2. You should have `oc` CLI tool in your environtment connected and logged into the mentioned OpenShift instance.
+3. The only part left is to run the script as follows:
+```bash
+$ ./gen_newe_kubeconf.sh -s <serviceaccont_name> -n <namespace>
+```
+Only the serviceaccount name and the namespace are required as parameters for the script.
+

contrib/oc-config4konflux/gen_new_kubeconf.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+#
+# This script generates a temporary Kubeconfig file authenticated with a
+# Service Account (SA) token for use with Kube/OpenShift workflows.
+#
+# It relies on being run by a user who has 'oc' permissions to create tokens and view cluster details.
+
+set -euo pipefail
+
+# Variables assigned from flags
+SA_NAME=""          # Flag: -s (REQUIRED)
+NAMESPACE=""        # Flag: -n (REQUIRED)
+KUBECONFIG_FILE=""  # Flag: -f
+TOKEN_LIFE=""       # Flag: -t
+CONTEXT_NAME=""     # Flag: -c
+CLUSTER_NAME=""     # Flag: -C
+CLUSTER_URL=""      # Flag: -u
+HELP=0
+
+# Hardcoded base defaults
+DEFAULT_FILE="sa-kubeconfig-$(date +%m%d).yaml"
+
+
+show_help() {
+    echo "Usage: $0 -s <SA_NAME> -n <NAMESPACE> [OPTIONS...]"
+    echo ""
+    echo "REQUIRED FLAGS:"
+    echo "  -s <NAME>    Service Account Name."
+    echo "  -n <NAME>    Namespace where the Service Account resides."
+    echo ""
+    echo "OPTIONAL FLAGS (Defaults are applied if not provided):"
+    echo "  -f <FILE>    Output Kubeconfig file path. (Default: $DEFAULT_FILE)"
+    echo "  -t <LIFE>    Token life duration (e.g., 1h, 8h). (Default: 8h)"
+    echo "  -c <NAME>    Kubeconfig Context Name. (Default: pungi-context)"
+    echo "  -C <NAME>    Cluster Name for the new config. (Default: \$SA_NAME-cluster)"
+    echo "  -u <URL>     Cluster API URL. (Default: Detected from current 'oc' config)"
+    echo "  -h           Show this help message and exit."
+}
+
+
+while getopts "s:n:f:t:c:C:u:h" opt; do
+    case $opt in
+        s) SA_NAME="$OPTARG" ;;
+        n) NAMESPACE="$OPTARG" ;;
+        f) KUBECONFIG_FILE="$OPTARG" ;;
+        t) TOKEN_LIFE="$OPTARG" ;;
+        c) CONTEXT_NAME="$OPTARG" ;;
+        C) CLUSTER_NAME="$OPTARG" ;;
+        u) CLUSTER_URL="$OPTARG" ;;
+        h) HELP=1 ;;
+        \?)
+            echo "Error: Invalid option -$OPTARG" >&2
+            exit 1
+            ;;
+    esac
+done
+
+# Check if help was requested
+if [ "$HELP" -eq 1 ]; then
+    show_help
+    exit 0
+fi
+
+
+# Validate required arguments after flag parsing
+if [ -z "$SA_NAME" ] || [ -z "$NAMESPACE" ]; then
+    echo "Error: Service Account Name (-s) and Namespace (-n) are required." >&2
+    show_help
+    exit 1
+fi
+
+# Apply defaults
+KUBECONFIG_FILE="${KUBECONFIG_FILE:-$DEFAULT_FILE}"
+TOKEN_LIFE="${TOKEN_LIFE:-8h}"
+CONTEXT_NAME="${CONTEXT_NAME:-pungi-context}"
+CLUSTER_NAME="${CLUSTER_NAME:-$SA_NAME-cluster}"
+# CLUSTER_URL default is handled inside the build_kubeconfig function
+
+# Retrieve SA token
+get_sa_token() {
+    echo "-> Generating time-bound token for SA '$SA_NAME' in '$NAMESPACE' (Life: $TOKEN_LIFE)..." >&2
+    
+    local SA_TOKEN_RAW
+    SA_TOKEN_RAW=$(oc create token "$SA_NAME" -n "$NAMESPACE" --duration="$TOKEN_LIFE" 2>/dev/null)
+    
+    if [[ $? -ne 0 ]] || [[ -z "$SA_TOKEN_RAW" ]]; then
+        echo "Error: Failed to retrieve SA token. Check SA name, namespace, and user permissions." >&2
+        exit 1
+    fi
+    # Export the token so it's available globally in the script
+    export SA_TOKEN="$SA_TOKEN_RAW"
+}
+
+# Assemble the Kubeconfig file
+build_kubeconfig() {
+    echo "-> Writing Kubeconfig to $KUBECONFIG_FILE" >&2
+    
+    # Get current cluster details if CLUSTER_URL was not passed via flag
+    if [[ -z "$CLUSTER_URL" ]]; then
+        echo "-> Detecting Cluster URL from current config..." >&2
+        # Assuming the current oc login gives access to the cluster URL
+        CLUSTER_URL=$(oc config view --minify -o jsonpath='{.clusters[0].cluster.server}')
+        if [[ -z "$CLUSTER_URL" ]]; then
+            echo "Error: Could not automatically determine CLUSTER_URL. Use the -u flag." >&2
+            exit 1
+        fi
+    fi
+    
+    # 1. Define the Cluster endpoint
+    oc config set-cluster "$CLUSTER_NAME" \
+        --server="$CLUSTER_URL" \
+        --kubeconfig="$KUBECONFIG_FILE" > /dev/null
+    
+    # 2. Define the Credentials (User and Token)
+    oc config set-credentials "$SA_NAME" \
+        --token="$SA_TOKEN" \
+        --kubeconfig="$KUBECONFIG_FILE" > /dev/null
+
+    # 3. Define the Context (Links the user, cluster, and namespace)
+    oc config set-context "$CONTEXT_NAME" \
+        --cluster="$CLUSTER_NAME" \
+        --user="$SA_NAME" \
+        --namespace="$NAMESPACE" \
+        --kubeconfig="$KUBECONFIG_FILE" > /dev/null
+
+}
+
+##############
+#### main ####
+##############
+
+get_sa_token
+build_kubeconfig
+
+echo ""
+echo "Kubeconfig successfully created:"
+echo "$PWD/$KUBECONFIG_FILE"