Difficulties Accessing Shoot Clusters for First Time Users

[Vedran Lerenc]

What would you like to be added:
People struggle to access their shoot clusters since the discontinuation of the static token kubeconfigs. Gardener provides web terminals (that they miss) and a CLI (that they have trouble setting up). I was watching over the shoulder of a new user and took notes where he struggled (corroborated/supported also by feedback via Slack, I believe).

• The user didn't really take notice of the web terminals. When I asked why, I understood, it wasn't clear to him. We agreed that if the short info would have been "Access cluster in web terminal with kubectl" (instead of "Open terminal into cluster or cluster's control plane") it would have been clearer to him.
• The user was heavily confused with garden and shoot cluster and couldn't differentiate. He tried to use the garden cluster kubeconfig (from https://endpoint/account?namespace=project saying "Personalized command line interface access (requires kubelogin kubectl plugin") to access the shoot cluster. It should probably mention or better show that it's not meant for any shoot cluster, but terminalogy is another problem (see below).
• People get confused with the terminology a lot, e.g. they think a shoot cluster is a garden cluster (because Gardener created it). If they heard of seed clusters (like in this case), some think the garden cluster is a seed cluster as they heard that term, but not that Gardener itself presents the garden cluster for LM operations to the end users. Some guides in the docs section are not the solution (he didn't know of them and wouldn't look there until he failed using the Dashboard without guides). There must be a better way, in the Dashboard, to transfer that mental image. Some graphic illustration as part of the cluster page maybe, highlighting the seed in garden<-seed<-shoot in the Infrastructure/Seed section of the cluster view and/or highlighting the garden in garden<-seed<-shoot when downloading the personal kubeconfig and/or highlighting the shoot in garden<-seed<-shoot when downloading the shoot kubeconfig or garden in garden<-seed<-shoot when explaining that gardenctl starts off the garden cluster. I am certain, we find a way to convey this topology information or at least help to "unconfuse" garden and shoot clusters better.
• The "Kubeconfig - Gardenlogin" info box is not easy to grasp.
• The "Kubeconfig - Static Token" option is available in the UI and fails on the last mile (people don't know that its discontinued until they press the Create button).
• "Target Cluster" and gardenctl was not understood. I am sure, we can explain in a more intuitive way, what tools exist and why you need them and against what they operate.
• On Windows, gardenctl target --garden <landscape> --project <project> --shoot <shoot> failed with (and the user had to use admin privileges: "run as administrator"):

Error: symlink C:\Users\...\AppData\Local\Temp\garden\some_uuid\kubeconfig.some_id.yaml C:\Users\...\AppData\Local\Temp\garden\some_uuid\kubeconfig.some_id.yaml: A required privilege is not held by the client.

Can we improve the experience?

Why is this needed:
Lower the entry barrier, make your first experience with Gardener more pleasing/less straining.

[alexander-kosolapov]

very valid remarks, upvote the issue!