We have discouraged Basic authentication in Google Kubernetes Engine (GKE) - google-cloud-platform

Question

I recently received an email from Google:
Hello Google Kubernetes Engine Customer,
We’re writing to remind you that we have discouraged Basic authentication in
Google Kubernetes Engine (GKE). This authentication strategy has been
disabled by default since version 1.12, because it does not align with
Googles’ security best practices and will no longer be supported in GKE,
starting from v1.19.
You’re receiving this message, because you’re currently using a
static password to authenticate for one or more of your GKE clusters.
How can I avoid using a static password, where is this kept? I don't remember setting this up.
I've referenced https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster. Am I right to understand I didn't do anything particularly to fall out of compliance except using the GCP automation prior to 1.12 and now need to take some sort of action to remain within current standards?
Want to ensure I understand the history and scope of this change and perhaps have a simplified video I can follow verbatim to ensure I don't fall into a downtime I can't get out of. Or just a set of commands if this is standard to maintain my current workflow and authenticate on my user that already has current access prior to 1.12 when I deploy my app.

Answer 1

Disabling basic authentication should not result in any downtime for your cluster.
The preferred method for authentication with the API server is OAuth and this should already be enabled for your cluster. You can check that this is working by running the following commands:
gcloud auth login
gcloud container clusters get-credentials $CLUSTERNAME --zone $ZONE
Running any kubectl command, e.g. kubectl cluster-info
Assuming all goes well there (and I can't think of any reason it will not), you'd then run
gcloud container clusters update CLUSTER_NAME --no-enable-basic-auth
in order to disable basic auth.
EDIT: If you need to (re)enable basic auth, you can run the foolowing command:
gcloud container clusters update --username=$USER --password=$PASS
where $USER and $PASS are the username and password you were previously using (or a new user/password if you choose).
Of course, if you have any automations using the Cloud SDK which use basic auth, you'd need to update those as well.