k10s v0.1.8

Kubeconfigs that log in through auth-provider: oidc connect now, release
archives are signed, and five HTTP/2 vulnerabilities in a dependency are gone.

OIDC kubeconfigs (#9)

A kubeconfig whose user logs in through auth-provider: oidc, which kubectl
reads natively, showed its context in the header and then failed:

clientset: no Auth Provider found for name "oidc"

client-go only knows the auth-provider plugins a program imports, and k10s
imported none. It now loads the same set kubectl does: oidc, plus stubs for the
removed gcp and azure providers that name what replaced them. An expired
id-token is refreshed against the identity provider and written back to the
kubeconfig file that holds the user, as kubectl does, in --readonly mode too:
the refresh goes to the identity provider, not to the cluster.

Signed releases (#15)

Every archive in this release carries a build provenance attestation, signed
through Sigstore by the release workflow, which shows it was built by this
repository's workflow from the tagged commit:

gh attestation verify k10s_v0.1.8_linux_amd64.tar.gz --repo p10node/k10s

mise verifies it by itself when it installs k10s from GitHub. checksums.txt
still matches each download to what this release published; the attestation is
what says who built it. Releases are now built with the newest Go 1.27 patch.

Correctness hardening (#10)

• An async operation stays tied to the source and session that started it, so a
  slow answer from a context you already left cannot land in the one on screen.
• Custom-resource rows carry their full identity, so Describe, YAML, Delete and
  Apply act on the object you selected.
• Edits keep the original resourceVersion: a conflicting change fails instead of
  being retried against a fresh copy.
• Drain checks for blockers first, evicts with UID preconditions, runs the
  evictions concurrently under one deadline, and never force-deletes.
• Log sessions stay pinned to the pod and container you chose, with bounded
  memory, and actions work before the informer caches have warmed up.
• Read-only mode blocks every external plugin, not only the ones marked
  dangerous: true.
• The updater requires a valid checksum manifest, and the release workflow
  installs the freshly built archive before publishing it.

Also

• The :ctx picker keeps its cursor on screen when the context list is long
  (#11), thanks, @p3rsephone.
• Pull requests are tested now: gofmt, go vet, go test and govulncheck on the two
  Go releases that get security fixes, and once a week with no change at all;
  Dependabot proposes dependency updates (#14).

Upgrading

golang.org/x/net is updated (#13, #22). The version in v0.1.7 has five
HTTP/2 vulnerabilities whose code k10s reaches through client-go (GO-2026-6617,
GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603), and v0.61.0 has two
more in its html package that k10s does not call (GO-2026-6866, GO-2026-6860).
govulncheck reports none for this release.

Read-only mode is stricter: every external plugin is blocked in it now, not
only the ones marked dangerous: true.

/update from inside k10s, checksum-verified, atomic, offers to restart into
the new binary.

curl -fsSL https://p10node.com/k10s/install.sh | sh
go install github.com/p10node/k10s@latest
gh attestation verify k10s_v0.1.8_<os>_<arch>.tar.gz --repo p10node/k10s   # .zip on Windows

Issues and friction reports: https://github.com/p10node/k10s/issues

What's Changed

• Load client-go auth-provider plugins so oidc kubeconfigs connect by @junior in #9
• fix: correctness hardening across k8s store, UI lifecycle and updater by @pierreneter in #10
• Keep the :ctx picker's cursor on screen when the context list is long by @p3rsephone in #11
• Update golang.org/x modules: fixes five HTTP/2 vulnerabilities in x/net by @junior in #13
• Test pull requests in CI, and add Dependabot by @junior in #14
• Sign release builds: attest every archive's build provenance by @junior in #15
• Update golang.org/x/net to v0.62.0 by @junior in #22
• docs(release): notes for v0.1.8 by @junior in #25

New Contributors

• @p3rsephone made their first contribution in #11

Full Changelog: v0.1.7...v0.1.8