docs: @SuppressWarnings("unchecked")
    private String tokenViaExecCredential(Map<String, Object> execMap) {
      if (execMap == null) {
        return null;
      }
      String apiVersion = (String) execMap.get("apiVersion");
      if (!"client.authentication.k8s.io/v1beta1".equals(apiVersion)
          && !"client.authentication.k8s.io/v1alpha1".equals(apiVersion)) {
        log.error("Unrecognized user.exec.apiVersion: {}", apiVersion);
        return null;
      }
      String command = (String) execMap.get("command");
      JsonElement root = runExec(command, (List) execMap.get("args"), (List) execMap.get("env"));
      if (root == null) {
        return null;
      }
      if (!"ExecCredential".equals(root.getAsJsonObject().get("kind").getAsString())) {
        log.error("Unrecognized kind in response");
        return null;
      }
      if (!apiVersion.equals(root.getAsJsonObject().get("apiVersion").getAsString())) {
        log.error("Mismatched apiVersion in response");
        return null;
      }
      JsonObject status = root.getAsJsonObject().get("status").getAsJsonObject();
      JsonElement token = status.get("token");
      if (token == null) {
        // TODO handle clientCertificateData/clientKeyData
        // (KubeconfigAuthentication is not yet set up for that to be dynamic)
        log.warn("No token produced by {}", command);
        return null;
      }
      log.debug("Obtained a token from {}", command);
      return token.getAsString();
      // TODO cache tokens between calls, up to .status.expirationTimestamp
      // TODO a 401 is supposed to force a refresh,
      // but KubeconfigAuthentication hardcodes AccessTokenAuthentication which does not support that
      // and anyway ClientBuilder only calls Authenticator.provide once per ApiClient;
      // we would need to do it on every request
    }