Add kubectl plugin

[lbajsarowicz]

Overview

Adds a kubectl shell plugin, as requested in the community thread "Any plans for creating a kubectl (.kube/config) CLI plugin?".

A kubeconfig can hold two kinds of static secrets: a bearer token, or a client certificate with its private key (client-certificate-data / client-key-data). The plugin moves those into a 1Password item (Address, Token, Certificate, Private Key, Certificate Authority) and provides them to kubectl only for the context whose cluster matches the item's Address.

How provisioning works: the plugin resolves the config sources the way kubectl does (--kubeconfig, then KUBECONFIG, then ~/.kube/config), merges them with kubectl's first-wins rules, and resolves the target context and server (--context, --cluster, --server, then current-context). When the server matches the item's Address, it writes a temporary kubeconfig overlay that redefines only that one context, pointing it at a per-invocation user that carries the item's secrets, and puts the overlay first in KUBECONFIG. Clusters, other contexts and current-context stay the user's own. When the server does not match, nothing is provisioned and kubectl behaves exactly as without the plugin, so kubectl config use-context and --context keep working (this is the class of problem reported for Argo CD in #526). With --kubeconfig F, the flag is moved into KUBECONFIG=<overlay>:F, the same approach the ngrok and aws plugins use to rewrite the command line. No secret ever appears in the command line.

The importer reads the active kubeconfig set (KUBECONFIG or ~/.kube/config) and offers one item per context with a static secret. Users authenticated through exec plugins or auth-provider (EKS, GKE, AKS, OIDC) have nothing to import and are left untouched; tokenFile users are skipped as their token is usually rotated.

Local-only commands (config, completion, options, plugin, kustomize, kuberc, help, version --client, shell completion) do not require authentication. config in particular must never run with the overlay, because config set-* writes into the first KUBECONFIG file.

Things worth a maintainer's opinion:

• PEM values are stored single-line base64, as they appear in kubeconfig *-data fields; the provisioner also accepts raw PEM. If multi-line fields are well supported in items, PEM could become the canonical form.
• Certificate and Private Key are reused for the client pair and one new field name, Certificate Authority, is added. Client Certificate / Client Key would be the alternative.
• On a machine with no kubeconfig at all (and no KUBECONFIG, KUBERNETES_SERVICE_HOST, KUBERNETES_MASTER), the item alone produces a standalone config for its cluster.
• Known limits, documented rather than solved: a kuberc file that declares aliases or connection-related defaults (server, context, cluster, user, auth, TLS, proxy) makes the plugin step aside, fail-closed, and KUBECTL_KUBERC=false is not honoured, so kuberc is always treated as active; external kubectl-* plugins are treated as needing the cluster; URL equality is the cluster identity, as in the Argo CD plugin.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• Relates: Plugin should respect context - kubectl context and/or argocd-context #526

How To Test

Unit tests cover the parser, the kubeconfig loader and merge rules, server normalisation, the provisioner (context match and mismatch, --kubeconfig, multi-file KUBECONFIG, fresh machine, impersonation fields, kuberc), the importer and the needs-auth rule:

go test ./plugins/kubectl/ -v
make kubectl/validate

With the CLI, using an item whose Address is your cluster's server and a kubeconfig that also has a second, local context:

make kubectl/build
op plugin init kubectl
kubectl get nodes                       # authenticated with the 1Password item
kubectl --context <local-context> get nodes   # untouched: uses the local context's own credentials
kubectl config view --minify            # shows the local context, no overlay, no prompt

op plugin init kubectl imports every context of ~/.kube/config (or the files in KUBECONFIG) that carries a token or a client certificate pair.

Verified end to end with 1Password CLI 2.40.0 and kubectl v1.37.1 against a Scaleway Kapsule cluster (Kubernetes 1.37): the token was imported from a kubeconfig obtained with scw k8s kubeconfig get … auth-method=legacy, kubectl get pods, logs and exec -it … -- sh authenticate through the item, and the same commands against a local docker-desktop context are left untouched.

Changelog

Authenticate kubectl with a token or client certificate stored in 1Password, provided only to the context that targets the item's cluster.