What would you like to be added:
gardenlogin v0.5 or higher supports the shoots/viewerkubeconfig subresource. As a result, users with the Project viewer role can now access the Shoot cluster with read-only permission.
In addition, the cluster CA can now be fetched via ConfigMap (gardener/gardener#9123). This allows the generation of the gardenlogin kubeconfig via gardenctl with only viewer permissions.

Therefore, it should be possible to target a Shoot cluster and interact with the cluster using the generated gardenlogin kubeconfig. However, ssh and the provider-env command will not work for viewers.

Why is this needed: