Add exec credential plugin policy (kuberc credentialPluginPolicy semantics)

[Copilot]

Kubeconfig exec credential plugins start local processes, and the Java client had no way to restrict them. This adds an application-controlled policy, like kubernetes-client/csharp#1930. Its semantics follow kubectl's kuberc credential plugin policy and client-go's matching logic.

Policy (ExecCredentialPluginPolicy)

• Policies: ALLOW_ALL (the default, so behaviour is unchanged), DENY_ALL, and allowlist(...).
• Allowlist matching (from client-go exec.go): an entry matches if it is exactly equal to the cleaned plugin command, or if both resolve through PATH (LookPath-style) to the same executable.
  • Symlinks and globs are not resolved.
  • Relative PATH directories are skipped, matching Go's ErrDot.
  • Windows PATHEXT is handled.
• What runs under an allowlist: the resolved path that passed the check, not a fresh PATH lookup at process start.
• Validation (matches ValidatePluginPolicy):
  • the allowlist must not be missing or empty;
  • entries must not be empty and must be clean paths (./foo is rejected);
  • an allowlist with a non-Allowlist policy is rejected;
  • unknown policy names are rejected.

kuberc loading

• fromKubeRc(Reader | File) parses a kubectl.config.k8s.io/* Preference document. It accepts name as the deprecated alias for command and rejects entries that set both.
• fromDefaultKubeRc() finds the file the way kubectl does:
  • KUBECTL_KUBERC=false or KUBERC=off disables kuberc, which means allow all.
  • An explicit $KUBERC file must exist and be valid.
  • A missing ~/.kube/kuberc is ignored. One that isn't valid YAML is ignored with a warning, as kubectl does. One that parses but has an invalid policy is a hard error.
• kuberc is not read automatically; applications opt in. client-go doesn't read kuberc either.

Enforcement

• KubeConfig.setExecCredentialPluginPolicy(...). The check runs in runExec before the process starts, after the existing kubeconfig-relative path resolution.
• Denials throw ExecCredentialPluginDeniedException, a RuntimeException with getCommand(). The exception propagates out of getCredentials(), so it fires both when the client is built and on token refresh through KubeconfigAuthentication.
• New overloads ClientBuilder.standard(policy) and ClientBuilder.standard(persistConfig, policy).

ApiClient client = ClientBuilder.standard(ExecCredentialPluginPolicy.DENY_ALL).build();

ApiClient client = ClientBuilder.standard(
    ExecCredentialPluginPolicy.allowlist("kubelogin", "/usr/local/bin/my-plugin")).build();

// Same policy kubectl would use
ApiClient client = ClientBuilder.standard(ExecCredentialPluginPolicy.fromDefaultKubeRc()).build();

Review notes

• Differs from the C# PR: in allowlist mode, kubeconfig env entries are still passed to the plugin. Rejecting them would not match kubectl and would break common plugins (for example ones that rely on AWS_PROFILE). The README describes the policy as defense in depth, not a sandbox.
• Fails open: a default kuberc that isn't valid YAML results in allow-all. This matches kubectl, but it is an easy place to fail closed instead if preferred.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Copilot
Once this PR has been reviewed and has the lgtm label, please ask for approval from brendandburns. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[linux-foundation-easycla]

• ✅ login: brendandburns / name: Brendan Burns (a13d403)
• ❌ - login: @copilot / name: copilot-swe-agent[bot]. The commit (a13d403) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.