Repository: external-secrets/external-secrets (go)

Issue:
kubernetes-provider auth broken after 0.9.20
**Describe the bug**
It seems that after the implementation of this feature for kubernetes provider on release v0.9.20: 

> add AuthRef to kubernetes provider fixes https://github.com/external-secrets/external-secrets/issues/3627 by @kaedwen in https://github.com/external-secrets/external-secrets/pull/3628

seems that stoped working only with "auth:" it gives the error:  could not get provider client: failed to prepare auth: no auth provider given

**To Reproduce**
Steps to reproduce the behavior:
Install version v.0.9.20 or newer

deploy a yaml like this:

``` yaml
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: k8s-secretstore
spec:
  provider:
    kubernetes:
      remoteNamespace: shared-secrets
      server:
        url: "https://x.x.x.x:6443"
        caProvider:
          type: ConfigMap
          name: kube-root-ca
          key: ca.crt
          namespace: "external-secrets"
      auth:
        cert:
          clientCert:
            name: "cluster-client"
            key: "tls.crt"
          clientKey:
            name: "cluster-client"
            key: "tls.key"
```

**Expected behavior**
Keep working with auth

**Screenshots**
This is the status of kind: SecretStore
``` yaml
status:
  capabilities: ReadWrite
  conditions:
    - lastTransitionTime: '2024-09-18T13:11:54Z'
      message: unable to create client
      reason: InvalidProviderConfig
      status: 'False'
      type: Ready
```
      
And the two lines on logs that are generated constantly with the error on app.kubernetes.io/name=external-secrets pod
``` jsonl
{"level":"error","ts":1726665196.5949998,"logger":"controllers.ClusterSecretStore","msg":"unable to validate store","clustersecretstore":{"name":"k8s-alm-secretstore"},"error":"could not get provider client: failed to prepare auth: no auth provider given","stacktrace":"github.com/external-secrets/external-secrets/pkg/controllers/secretstore.reconcile\n\t/home/runner/work/external-secrets/external-secrets/pkg/controllers/secretstore/common.go:69\ngithub.com/external-secrets/external-secrets/pkg/controllers/secretstore.(*ClusterStoreReconciler).Reconcile\n\t/home/runner/work/external-secrets/external-secrets/pkg/controllers/secretstore/clustersecretstore_controller.go:65\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:116\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:303\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:224"}
{"level":"error","ts":1726665196.6100624,"msg":"Reconciler error","controller":"clustersecretstore","controllerGroup":"external-secrets.io","controllerKind":"ClusterSecretStore","ClusterSecretStore":{"name":"k8s-alm-secretstore"},"namespace":"","name":"k8s-alm-secretstore","reconcileID":"a83fe0c9-b660-44e4-985f-b5d5c827ea95","error":"could not get provider client: failed to prepare auth: no auth provider given","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:224"}
```

**Additional context**
Going back to 0.9.19 works perfect


Pull request description:
fix cert auth without token fixed #3926
## Problem Statement

Issue stated that creating a SecretStore with key/cert only does fail

## Related Issue

Fixes #3926

## Proposed Changes

Do not fail when there is not token given

## Checklist

- [X] I have read the [contribution guidelines](https://external-secrets.io/latest/contributing/process/#submitting-a-pull-request)
- [X] All commits are signed with `git commit --signoff`
- [X] My changes have reasonable test coverage
- [X] All tests pass with `make test`
- [X] I ensured my PR is ready for review with `make reviewable`


Patch:
diff --git a/pkg/provider/kubernetes/auth.go b/pkg/provider/kubernetes/auth.go
index d62b23cd1..8d7eeaf66 100644
--- a/pkg/provider/kubernetes/auth.go
+++ b/pkg/provider/kubernetes/auth.go
@@ -44,6 +44,14 @@ func (c *Client) getAuth(ctx context.Context) (*rest.Config, error) {
 		return clientcmd.RESTConfigFromKubeConfig(cfg)
 	}
 
+	if c.store.Server.URL == "" {
+		return nil, errors.New("no server URL provided")
+	}
+
+	cfg := &rest.Config{
+		Host: c.store.Server.URL,
+	}
+
 	ca, err := utils.FetchCACertFromSource(ctx, utils.CreateCertOpts{
 		CABundle:   c.store.Server.CABundle,
 		CAProvider: c.store.Server.CAProvider,
@@ -55,43 +63,39 @@ func (c *Client) getAuth(ctx context.Context) (*rest.Config, error) {
 		return nil, err
 	}
 
-	var token []byte
-	if c.store.Auth.Token != nil {
-		token, err = c.fetchSecretKey(ctx, c.store.Auth.Token.BearerToken)
+	cfg.TLSClientConfig = rest.TLSClientConfig{
+		Insecure: false,
+		CAData:   ca,
+	}
+
+	switch {
+	case c.store.Auth.Token != nil:
+		token, err := c.fetchSecretKey(ctx, c.store.Auth.Token.BearerToken)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch Auth.Token.BearerToken: %w", err)
 		}
-	} else if c.store.Auth.ServiceAccount != nil {
-		token, err = c.serviceAccountToken(ctx, c.store.Auth.ServiceAccount)
+
+		cfg.BearerToken = string(token)
+	case c.store.Auth.ServiceAccount != nil:
+		token, err := c.serviceAccountToken(ctx, c.store.Auth.ServiceAccount)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch Auth.ServiceAccount: %w", err)
 		}
-	} else {
-		return nil, errors.New("no auth provider given")
-	}
 
-	var key, cert []byte
-	if c.store.Auth.Cert != nil {
-		key, cert, err = c.getClientKeyAndCert(ctx)
+		cfg.BearerToken = string(token)
+	case c.store.Auth.Cert != nil:
+		key, cert, err := c.getClientKeyAndCert(ctx)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch client key and cert: %w", err)
 		}
-	}
 
-	if c.store.Server.URL == "" {
-		return nil, errors.New("no server URL provided")
+		cfg.TLSClientConfig.KeyData = key
+		cfg.TLSClientConfig.CertData = cert
+	default:
+		return nil, errors.New("no auth provider given")
 	}
 
-	return &rest.Config{
-		Host:        c.store.Server.URL,
-		BearerToken: string(token),
-		TLSClientConfig: rest.TLSClientConfig{
-			Insecure: false,
-			CertData: cert,
-			KeyData:  key,
-			CAData:   ca,
-		},
-	}, nil
+	return cfg, nil
 }
 
 func (c *Client) getClientKeyAndCert(ctx context.Context) ([]byte, []byte, error) {


Test patch:
diff --git a/pkg/provider/kubernetes/auth_test.go b/pkg/provider/kubernetes/auth_test.go
index 84e2a0d75..7c3feb75c 100644
--- a/pkg/provider/kubernetes/auth_test.go
+++ b/pkg/provider/kubernetes/auth_test.go
@@ -250,14 +250,6 @@ func TestSetAuth(t *testing.T) {
 						"cert": []byte("my-cert"),
 						"key":  []byte("my-key"),
 					},
-				}, &corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "foobar",
-						Namespace: "default",
-					},
-					Data: map[string][]byte{
-						"token": []byte("mytoken"),
-					},
 				}).Build(),
 				store: &esv1beta1.KubernetesProvider{
 					Server: esv1beta1.KubernetesServer{
@@ -265,13 +257,6 @@ func TestSetAuth(t *testing.T) {
 						CABundle: []byte(caCert),
 					},
 					Auth: esv1beta1.KubernetesAuth{
-						Token: &esv1beta1.TokenAuth{
-							BearerToken: v1.SecretKeySelector{
-								Name:      "foobar",
-								Namespace: pointer.To("shouldnotberelevant"),
-								Key:       "token",
-							},
-						},
 						Cert: &esv1beta1.CertAuth{
 							ClientCert: v1.SecretKeySelector{
 								Name: "mycert",
@@ -286,8 +271,7 @@ func TestSetAuth(t *testing.T) {
 				},
 			},
 			want: &want{
-				Host:        "https://my.test.tld",
-				BearerToken: "mytoken",
+				Host: "https://my.test.tld",
 				TLSClientConfig: rest.TLSClientConfig{
 					CAData:   []byte(caCert),
 					CertData: []byte("my-cert"),