feat(ske): add ephemeral ske kubeconfig

[h3adex]

Description

This PR adds the stackit_ske_kubeconfig ephemeral resource. The default expiration has been reduced to 30 minutes. Since these credentials only need to persist for the duration of a Terraform run, where even slow Helm deployments rarely exceed a 10-15 minute window, a 60-minute expiration is excessive.

Tested example code:
https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/pulls/18

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Acceptance tests got implemented or updated (see e.g. here)
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)

[h3adex]

don't review yet. E2E tests still open

[h3adex]

E2E Tests

[github-actions]

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

[rubenhoenle]

Suggested change

	defaultKubeconfigExpiration = 1800
	defaultKubeconfigExpirationSeconds = 1800

Please add a time unit to that one

[h3adex]

Removed entirely. Per your feedback on the broader expiration approach, the custom 1800s default was dropped altogether. The API default of 3600s (1h) is now used when no expiration is specified, documented in the schema description.

[rubenhoenle]

Suggested change

	"Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).",
	"Defaults to `1800` (30m) for optimal security during Terraform operations.",

Isn't the point of Terraform that users don't have to care about the underlying APIs? 😄

[h3adex]

see above

[rubenhoenle]

Suggested change

	expiration = new(int64)
	expiration = new(int64(defaultKubeconfigExpiration))

[h3adex]

see above

[rubenhoenle]

If you turn the order around you don't need the ugly expirationStringPtr variable.

payload := ske.CreateKubeconfigPayload{}

if expiration != nil {
    payload.ExpirationSeconds = new(strconv.FormatInt(*expiration, 10))
}

But I have so many questions in my mind here.

• Why is ExpirationSeconds a string in the API?
• Why is the expiration parameter in this getKubeconfig function implementation a pointer type? I thought there was a default expiration time? What you're doing is critical since you risk that there's no expiration set by accident.

[h3adex]

Both addressed: getKubeconfig now takes ske.DefaultAPI (interface, not *ske.APIClient) and *int64. When nil, no ExpirationSeconds is sent and the API uses its default. The expirationStringPtr variable is gone, replaced with a local expirationStr scoped to the if expiration != nil block:

payload := ske.CreateKubeconfigPayload{}
if expiration != nil {
   expirationStr := strconv.FormatInt(*expiration, 10)
   payload.ExpirationSeconds = &expirationStr
}

[rubenhoenle]

I don't think this is needed, please use the SDK mocks instead if possible. See the link below for reference.

https://github.com/stackitcloud/stackit-sdk-go/blob/f40e129190c6736017f4904a6220c6dd28061a07/services/ske/v2api/api_default_mock.go#L22

[h3adex]

Done. The test now uses ske.DefaultAPIServiceMock with CreateKubeconfigExecuteMock.

[rubenhoenle]

I don't think this will work as you expect it. The internal id attribute of the cluster resource might be already set BEFORE the cluster creation wait handler is called / finished.

[rubenhoenle]

This isn't currently the case, but I would like to see some actual long-term working strategy here please.

[h3adex]

The cluster Create implementation: id is not set early. Only project_id, region, and name are written to state before the wait handler. The id attribute is only populated by mapFields, which runs after CreateClusterWaitHandler

So the ternary on id is safe:

• During plan for a new cluster: id is unknown (UseStateForUnknown, not yet in state), ternary is unknown, ephemeral Open is deferred to apply
• During apply: id is only set once the wait handler finishes and mapFields runs, cluster is guaranteed to exist when the ephemeral resource opens

Imo there is no better long-term strategy unless SKE introduces a UUID cluster identifier in the future. The problem is fundamentally unsolvable as long as the user can set the unique identifier (name) that is used in the Terraform state.

[rubenhoenle]

same here

[rubenhoenle]

and here

[rubenhoenle]

@h3adex please mark my conversations you adressed with your latest changes as resolved so this PR doesn't become a mess of open comments. Thanks.

[h3adex]

@rubenhoenle only rebased. I'll try to update this PR this month. Currently busy covering multiple topics. Will update you once I covered your comments.