fix(kapsule): allow getting kubeconfig with readonly permission

Author: jtherin

go.mod

@@ -23,7 +23,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20
 	github.com/moby/buildkit v0.25.1
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251002202252-ab1363c81acf
+	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251014133246-1080af8a8039
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10

go.sum

@@ -462,8 +462,8 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251002202252-ab1363c81acf h1:mz7af7+CKpRvbZMilDwowLtNOQ0sZOYdTAjdkG9lRho=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251002202252-ab1363c81acf/go.mod h1:DVB9HV7nK7TdTRqlpdxw6T0Wxg+aB9xPBEpO3aM2iqQ=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251014133246-1080af8a8039 h1:jQtzY/CcJKOMQl6p8yfSBgF0Am9As2myjla35QQ6QOw=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251014133246-1080af8a8039/go.mod h1:SVm1Zk6UpZtqZN6KtEQpjC+v+Lir4tyVfhQTU19q3PA=
 github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
 github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbmfHkLguCE9laoZCUzEEpIZXA=

internal/namespaces/k8s/v1/custom_kubeconfig_get.go

@@ -72,6 +72,7 @@ func k8sKubeconfigGetRun(ctx context.Context, argsI any) (i any, e error) {
 		GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 			Region:    request.Region,
 			ClusterID: request.ClusterID,
+			Redacted:  scw.BoolPtr(request.AuthMethod != authMethodLegacy), // put true after legacy deprecation
 		})
 	if err != nil {
 		return nil, err

internal/namespaces/k8s/v1/custom_kubeconfig_get_test.go

@@ -1,13 +1,16 @@
 package k8s_test
 
 import (
+	"fmt"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/ghodss/yaml"
 	"github.com/scaleway/scaleway-cli/v2/core"
 	"github.com/scaleway/scaleway-cli/v2/internal/namespaces/k8s/v1"
 	api "github.com/scaleway/scaleway-cli/v2/internal/namespaces/k8s/v1/types"
+	k8ssdk "github.com/scaleway/scaleway-sdk-go/api/k8s/v1"
 	"github.com/scaleway/scaleway-sdk-go/scw"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -17,7 +20,6 @@ func Test_GetKubeconfig(t *testing.T) {
 	////
 	// Simple use case
 	////
-
 	t.Run("simple", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
 		BeforeFunc: createClusterAndWaitAndKubeconfig(
@@ -283,9 +285,34 @@ func Test_GetKubeconfig(t *testing.T) {
 	t.Run("legacy", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
 		Cmd:      "scw k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }} auth-method=legacy",
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-legacy",
-		),
+		BeforeFunc: func(ctx *core.BeforeFuncCtx) error {
+			cmd := fmt.Sprintf(
+				"scw k8s cluster create name=cli-test-%s version=%s cni=cilium pools.0.node-type=DEV1-M pools.0.size=1 pools.0.name=default --wait",
+				"get-kubeconfig-legacy",
+				kapsuleVersion,
+			)
+			res := ctx.ExecuteCmd(strings.Split(cmd, " "))
+			cluster := res.(*k8ssdk.Cluster)
+			ctx.Meta[clusterMetaKey] = cluster
+
+			apiKubeconfig, err := k8ssdk.NewAPI(ctx.Client).
+				GetClusterKubeConfig(&k8ssdk.GetClusterKubeConfigRequest{
+					Region:    cluster.Region,
+					ClusterID: cluster.ID,
+					Redacted:  scw.BoolPtr(false),
+				})
+			if err != nil {
+				return err
+			}
+
+			var kubeconfig api.Config
+			if err = yaml.Unmarshal(apiKubeconfig.GetRaw(), &kubeconfig); err != nil {
+				return err
+			}
+			ctx.Meta[kubeconfigMetaKey] = kubeconfig
+
+			return nil
+		},
 		Check: core.TestCheckCombine(
 			core.TestCheckExitCode(0),
 			func(t *testing.T, ctx *core.CheckFuncCtx) {

internal/namespaces/k8s/v1/custom_kubeconfig_install.go

@@ -86,6 +86,7 @@ func k8sKubeconfigInstallRun(ctx context.Context, argsI any) (i any, e error) {
 		GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 			Region:    request.Region,
 			ClusterID: request.ClusterID,
+			Redacted:  scw.BoolPtr(request.AuthMethod != authMethodLegacy), // put true after legacy deprecation
 		})
 	if err != nil {
 		return nil, err

internal/namespaces/k8s/v1/helpers_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/scaleway/scaleway-cli/v2/core"
 	go_api "github.com/scaleway/scaleway-cli/v2/internal/namespaces/k8s/v1/types"
 	k8s "github.com/scaleway/scaleway-sdk-go/api/k8s/v1"
+	"github.com/scaleway/scaleway-sdk-go/scw"
 )
 
 const (
@@ -60,6 +61,7 @@ func createClusterAndWaitAndKubeconfig(
 			GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 				Region:    cluster.Region,
 				ClusterID: cluster.ID,
+				Redacted:  scw.BoolPtr(true),
 			})
 		if err != nil {
 			return err