chore: make k8s auth providers opt-in with build tag

README.md

@@ -131,3 +131,13 @@ approver would make it quite hard for an attacker to start forging CSRs.
 For sure, this simply requires modifying the `ProviderChecks(csr , x509csr))`
 function to implement additional checks (such as validating the node identity
 in an external inventory)
+
+# build and development
+
+when building locally to run the csr approver on an actual cluster with e.g. the
+`oidc` authentication provider, you need to use the tag `debug` to import all
+authentication providers. you will then build as follows:
+
+```bash
+go build -tags debug ./cmd/kubelet-csr-approver/
+```

internal/cmd/cmd.go

@@ -14,7 +14,6 @@ import (
 	"github.com/go-logr/zapr"
 	"github.com/peterbourgon/ff/v3"
 	"github.com/postfinance/flash"
-	_ "k8s.io/client-go/plugin/pkg/client/auth" //TODO: remove when used in-cluster
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 

internal/cmd/k8s-auth.go

@@ -0,0 +1,7 @@
+//go:build debug
+
+package cmd
+
+import (
+	_ "k8s.io/client-go/plugin/pkg/client/auth" // permits to use all authentication providers
+)