code: func (s *DelegatingAuthenticationOptions) getClient() (kubernetes.Interface, error) {
  	var clientConfig *rest.Config
  	var err error
  	if len(s.RemoteKubeConfigFile) > 0 {
  		loadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: s.RemoteKubeConfigFile}
  		loader := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{})
  
  		clientConfig, err = loader.ClientConfig()
  	} else {
  		// without the remote kubeconfig file, try to use the in-cluster config.  Most addon API servers will
  		// use this path. If it is optional, ignore errors.
  		clientConfig, err = rest.InClusterConfig()
  		if err != nil && s.RemoteKubeConfigFileOptional {
  			if err != rest.ErrNotInCluster {
  				klog.Warningf("failed to read in-cluster kubeconfig for delegated authentication: %v", err)
  			}
  			return nil, nil
  		}
  	}
  	if err != nil {
  		return nil, fmt.Errorf("failed to get delegated authentication kubeconfig: %v", err)
  	}
  
  	// set high qps/burst limits since this will effectively limit API server responsiveness
  	clientConfig.QPS = 200
  	clientConfig.Burst = 400
  
  	return kubernetes.NewForConfig(clientConfig)
  }
docs: // getClient returns a Kubernetes clientset. If s.RemoteKubeConfigFileOptional is true, nil will be returned
  // if no kubeconfig is specified by the user and the in-cluster config is not found.