From a781e6a7a7dcc5ed4647476a0e072a00d893ce7a Mon Sep 17 00:00:00 2001 From: Adao Oliveira Jr Date: Wed, 11 Nov 2026 20:59:09 -0600 Subject: [PATCH 1/2] docs(release): notes for v0.1.10 Signed-off-by: Adao Oliveira Jr --- docs/releases/v0.1.10.md | 92 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 docs/releases/v0.1.10.md diff --git a/docs/releases/v0.1.10.md b/docs/releases/v0.1.10.md new file mode 100644 index 0000000..0a94a7d --- /dev/null +++ b/docs/releases/v0.1.10.md @@ -0,0 +1,92 @@ +**Credential plugins such as `tsh`, `aws` and `kubelogin` stay off the +terminal**, so a login prompt no longer hangs k10s, and the plugin's own +words, where it has any, say what to do. **Plugins that run a shell's `-c` +script with options around `-c`, or through `env` or `busybox`, now get +k10s's values through the environment too**, so a value from the cluster, +such as a column's text, can no longer run as part of their script. + +## Credential plugins stay off the terminal ([#41](https://github.com/p10node/k10s/pull/41)) + +Many kubeconfig users get their token from a program: `tsh kube credentials` +(Teleport), `aws eks get-token`, `kubelogin`, `gke-gcloud-auth-plugin`. +client-go handed that program the terminal's input whenever there was one, so +under k10s a relogin or MFA prompt read keystrokes meant for k10s and wrote over +the screen, and the session looked hung. + +- The plugin now runs without the terminal's input, as kubectl runs it when + stdin is taken: one that would have prompted fails at once instead of + waiting, and one that declares `interactiveMode: Always` is refused before it + runs. +- What the plugin writes to stderr no longer lands on the screen. Its last line + becomes the No cluster reason, such as `credential plugin tsh: Having + problems with relogin, please use 'tsh login/tsh kube login' manually`, + instead of `exec: executable tsh failed with exit code 1`. +- A slow plugin no longer turns into No cluster: when the first request times + out with a plugin in use, k10s asks once more, with the credentials the + plugin has fetched by then. +- While k10s connects, the status line names the plugin it is waiting on. + `/setup` and + [docs/cluster-setup.md](https://github.com/p10node/k10s/blob/main/docs/cluster-setup.md) + have a section on credential plugins, with Teleport's caveats. + +## Values reach every `-c` script through the environment ([#40](https://github.com/p10node/k10s/pull/40)) + +When a plugin's command is a shell with `-c`, k10s gives the script the values +it fills in, such as `$NAME`, `$NAMESPACE` and `$COL-STATUS`, as environment +variables, so the shell never reads a value as code. Until this release that +held only when the script came right after the first option that holds `c`, +such as `-c` or `-ec`, and the command itself was the shell. In these command +lines k10s pasted the values into the script's text, and a value that held +shell syntax ran as part of the script: + +- options between `-c` and the script: `sh -c -x '...'`, + `sh -c -o errexit '...'`, `sh -c -- '...'`; +- a shell run through another program: `env bash -c '...'`, + `busybox sh -c '...'`. + +k10s now reads a shell's options the way the shells do, and finds the shell +behind `env` and `busybox`. Arguments after the script, which the shell passes +as `$0`, `$1` and so on, still get the values as text, so +`sh -c '... "$1"' sh $NAME` works as before. When k10s cannot tell which +argument is the script, every argument reads the values from the environment. + +`env -S` builds a command line of its own from a string and expands `${VAR}` +in it, so the environment cannot keep a value out of it. As with `python3 -c`, +what such a plugin does with the values is up to the plugin. +[docs/plugins.md](https://github.com/p10node/k10s/blob/main/docs/plugins.md) +and [SECURITY.md](https://github.com/p10node/k10s/blob/main/SECURITY.md) say +how values reach a `-c` script. Thanks to +[@pierreneter](https://github.com/pierreneter), who found it while reviewing +[#28](https://github.com/p10node/k10s/pull/28). + +## Also + +- `k10s --help` says that read-only mode blocks every external plugin, as it + does, not only dangerous ones ([#39](https://github.com/p10node/k10s/pull/39)). + +## Upgrading + +A credential plugin can no longer ask for anything while k10s runs: log in with +it first, or in another shell, then press `r`. + +A plugin whose `-c` script comes after options, or whose shell runs through +`env` or `busybox`, now reads its values from the environment, as a plain +`sh -c '...'` plugin already did. Quote them in the script as any shell +variable: `"$NAME"`, not `'$NAME'`, which the shell leaves as it is. A command +line k10s cannot read, such as one with bash's `-O`, gets the environment in +every argument, so a value passed as `$1` arrives as `$NAME`: set such an +option inside the script instead, for example with `shopt -s extglob`. + +govulncheck reports none for this release. + +`/update` from inside k10s, checksum-verified, atomic, offers to restart into +the new binary; a Homebrew install upgrades with `brew upgrade k10s`. + +```bash +curl -fsSL https://p10node.com/k10s/install.sh | sh +brew install p10node/tap/k10s +go install github.com/p10node/k10s@latest +gh attestation verify k10s_v0.1.10__.tar.gz --repo p10node/k10s # .zip on Windows +``` + +Issues and friction reports: https://github.com/p10node/k10s/issues From db29c12080c91cdbf6eef520d42bf14635604a81 Mon Sep 17 00:00:00 2001 From: Adao Oliveira Jr Date: Wed, 11 Nov 2026 22:40:57 -0600 Subject: [PATCH 2/2] docs(release): add #44 to the v0.1.10 notes Signed-off-by: Adao Oliveira Jr --- docs/releases/v0.1.10.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/releases/v0.1.10.md b/docs/releases/v0.1.10.md index 0a94a7d..539b711 100644 --- a/docs/releases/v0.1.10.md +++ b/docs/releases/v0.1.10.md @@ -63,6 +63,8 @@ how values reach a `-c` script. Thanks to - `k10s --help` says that read-only mode blocks every external plugin, as it does, not only dangerous ones ([#39](https://github.com/p10node/k10s/pull/39)). +- If k10s crashes, the stack trace is printed once the terminal is back to + normal, ready for a bug report ([#44](https://github.com/p10node/k10s/pull/44)). ## Upgrading