What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

Currently the kubectl plugin will assume the correct CA cert to use to verify the signer of a Kubernetes API serivce will be the same as that used by kubectl. However, TLS termination may differ between inside and outside of the Kubernetes environment and this can cause certificate validation errors when the operator within the Kubernetes cluster attempts a connection to member clusters.

What would you like to see happen?

Describe the desired outcome or enhancement.

Allow for handling this in a GitOps workflow using the kubectl plugin -- in particular the ability to programmatically create a service account and token in an automated manner to connect to the member clusters. Potentially, via a listing of internal CA certificate files to associate with each member Kubernetes context in the order they were specified.

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

Manual effort is involved in manually creating the service accounts and tokens whenever adding new member clusters, which can be considerable.

What steps, if any, are you taking today to manage this problem?

Manual methods -- this cannot be performed in an automated manner.