code: func buildKubeConfigFromSpec(spec *kubeConfigSpec, clustername string) (*clientcmdapi.Config, error) {
  
  	// If this kubeconfig should use token
  	if spec.TokenAuth != nil {
  		// create a kubeconfig with a token
  		return kubeconfigutil.CreateWithToken(
  			spec.APIServer,
  			clustername,
  			spec.ClientName,
  			pkiutil.EncodeCertPEM(spec.CACert),
  			spec.TokenAuth.Token,
  		), nil
  	}
  
  	// otherwise, create a client certs
  	clientCertConfig := certutil.Config{
  		CommonName:   spec.ClientName,
  		Organization: spec.ClientCertAuth.Organizations,
  		Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
  	}
  	clientCert, clientKey, err := pkiutil.NewCertAndKey(spec.CACert, spec.ClientCertAuth.CAKey, &clientCertConfig)
  	if err != nil {
  		return nil, errors.Wrapf(err, "failure while creating %s client certificate", spec.ClientName)
  	}
  
  	encodedClientKey, err := keyutil.MarshalPrivateKeyToPEM(clientKey)
  	if err != nil {
  		return nil, errors.Wrapf(err, "failed to marshal private key to PEM")
  	}
  	// create a kubeconfig with the client certs
  	return kubeconfigutil.CreateWithCerts(
  		spec.APIServer,
  		clustername,
  		spec.ClientName,
  		pkiutil.EncodeCertPEM(spec.CACert),
  		encodedClientKey,
  		pkiutil.EncodeCertPEM(clientCert),
  	), nil
  }
docs: // buildKubeConfigFromSpec creates a kubeconfig object for the given kubeConfigSpec