Add security policy support for kubeconfig exec credential plugins #1918

The C# client supports exec credential plugins in kubeconfig files, but currently executes the configured command whenever the selected user has an exec section.

This is a problem for applications that load kubeconfig content from users, tenants, or other untrusted sources. A kubeconfig can cause the client to start an arbitrary local process. Applications can inspect the kubeconfig before passing it to the client, but that means each application has to implement its own parsing and policy enforcement.

It would be useful for the client to provide an application-controlled policy for exec plugins, similar to the support recently added to Kubernetes client-go and exposed by kubectl through kuberc.

One possible design would include these modes:

• AllowAll: allow any exec plugin, preserving the current behavior by default.
• DenyAll: prevent exec plugins from running.
• Allowlist: allow only specific commands or executable paths.

For example, an application might configure:

var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(
    kubeConfig,
    new KubernetesClientConfigurationOptions
    {
        ExecCredentialPluginPolicy = ExecCredentialPluginPolicy.DenyAll
    });

Or allow only selected plugins:

var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(
    kubeConfig,
    new KubernetesClientConfigurationOptions
    {
        ExecCredentialPluginPolicy =
            ExecCredentialPluginPolicy.Allowlist(
                "kubelogin",
                @"C:\\Program Files\\Contoso\\trusted-plugin.exe")
    });

The exact API is open to discussion. A policy callback or another application-supplied policy type could also work.

For security, the policy could come from the application rather than the kubeconfig. This would prevent an untrusted kubeconfig from changing an application-selected DenyAll policy to AllowAll.

Allowlist matching could cover both command basenames and full paths. For example, an application could allow kubelogin or an exact path to a trusted executable. Empty or invalid allowlists could fail closed.

The policy check could happen immediately before the process starts. A denied execution could return a clear, distinguishable error without starting the process.

This would allow applications to preserve the current behavior, reject all exec plugins, or allow only explicitly approved credential plugins without duplicating kubeconfig parsing and process-launch logic.