fix: accept line breaks in kubeconfig certificate data

[nklmilojevic]

Kubeconfig certificate and key data with line breaks fails in the strict base64 decoder used by kube-rs. This also affects YAML !!binary values when their decoded content contains line breaks, although kubectl accepts them.

Remove CR and LF from inline CA, client certificate, and client key data before building the configuration. Use the shared loader for startup, context selection, completion, and sanitize commands. Other invalid characters remain rejected.

Allow configuration inference to try in-cluster authentication before reporting a missing current-context. Keep a successful inferred configuration, retain the context-selection message when inference fails, and omit empty context names from shell commands.

Validation: just check passed. Regression tests cover plain YAML and !!binary, wrapped and unwrapped data, invalid characters, startup, and context selection through handle_key. Tests also cover accepted service-account configuration results, failed inference, and both headless modes without a current context. These tests use local fixtures and simulated inference results; they do not need a cluster.

The first commit hook run failed in the existing port-forward test after it released a local port. The test passed when run alone, and all commit hooks passed on the next run.

Closes #635

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness, security, or repository-rule issues identified.

Summary

This PR introduces a shared kubeconfig loader that normalizes CR and LF in inline certificate and key data before kube-rs performs strict Base64 decoding.

• Applies normalization to startup, context selection, completion, and sanitize paths.
• Preserves upstream in-cluster fallback behavior and debug overrides.
• Retains rejection of invalid non-line-break characters.
• Adds coverage for plain YAML and !!binary values, wrapped and unwrapped credentials, startup, and context switching.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Read kubeconfig] --> B[Normalize CR/LF in inline CA, certificate, and key data]
    B --> C[Build kube-rs Config]
    C -->|Success| D[Apply debug and proxy configuration]
    C -->|Failure during inference| E[Use upstream Config::infer]
    E -->|In-cluster succeeds| D
    E -->|All inference fails| F[Return contextualized configuration error]
    D --> G[Build Kubernetes client]

Loading

_{Reviews (3) · Last reviewed commit: "fix: preserve in-cluster fallback withou..."}