add optional netrc authentication support for plugin downloads

[dkulchinsky]

Related issue: #896

This PR adds support for netrc authentication when downloading kubectl plugins, allowing users to access private plugin repositories that require HTTP Basic authentication.

Changes

New CLI flags:

--enable-netrc: Enable netrc authentication for downloads
--netrc-file: Specify custom netrc file path (defaults to ~/.netrc)

Implementation:

• Updated HTTP fetcher to conditionally check netrc credentials
• Added support for both plugin archive downloads and manifest URL downloads
• netrc support is opt-in and disabled by default
• When netrc is enabled and credentials cannot be loaded/parsed (including missing netrc file), the command fails with an error

Usage

# Use default ~/.netrc file
kubectl krew install --enable-netrc my-private-plugin

# Use custom netrc file
kubectl krew install --enable-netrc --netrc-file /path/to/netrc my-plugin

# Install from manifest URL with authentication
kubectl krew install --enable-netrc --manifest-url https://private-repo.com/manifest.yaml

Example .netrc entry:

machine private-repo.com
  login myuser
  password mypass

This enables krew to work with private plugin repositories while maintaining backward compatibility and security best practices.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dkulchinsky / name: Danny Kulchinsky (09a18f6, 16e074b, 2b7d03a, 3fa9ba1, 5011db9, 5badbc2, bca6555, dbd5915, e3e0e15)

[k8s-ci-robot]

Welcome @dkulchinsky!

It looks like this is your first PR to kubernetes-sigs/krew 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/krew has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[ahmetb]

mostly good

[dkulchinsky]

mostly good

thank you @ahmetb for the review, I believe I addressed all the comments, very helpful!

let me know if you have any other concerns.

[ahmetb]

/lgtm
/approve
Thanks!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahmetb, dkulchinsky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ahmetb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dkulchinsky]

wonderful news @ahmetb! thank you again for the review & approval 😄

not to sound pushy 😅 but any chance a release can be triggered to include this change? we can't wait to drop our private fork, haha

[ahmetb]

@dkulchinsky I don't think you've sent a docs PR yet?

[dkulchinsky]

@dkulchinsky I don't think you've sent a docs PR yet?

@ahmetb not yet, was just looking for it.

Looks like:

• https://github.com/kubernetes-sigs/krew/blob/master/site/content/docs/user-guide/install.md

• https://github.com/kubernetes-sigs/krew/blob/master/site/content/docs/user-guide/upgrade.md

I'll get that PR ready 👍🏼

[dkulchinsky]

@ahmetb here's the docs PR: #899

I ended up adding it to https://github.com/kubernetes-sigs/krew/blob/master/site/content/docs/user-guide/using-custom-indexes.md as I felt it's more appropriate context-wise, but happy to revise or add more info if needed.

[dkulchinsky]

Hey @ahmetb 👋🏼

With the docs changes now merged & live, I'm hoping a krew release can be triggered? 🙏🏼

[ahmetb]

I can help shortly. Have you had a chance to compile and test it locally by the way?

[dkulchinsky]

I can help shortly. Have you had a chance to compile and test it locally by the way?

@ahmetb sure did! works as designed :)

❯ ~/bin/krew install --enable-netrc foo/rt
Updated the local copy of plugin index.
Updated the local copy of plugin index "foo".
Installing plugin: rt
Installed plugin: rt
\
 | Use this plugin:
 |      kubectl rt
 | Documentation:
 |      https://github.com/foo/foo-krew/tree/main/src/rt
 | Caveats:
 | \
 |  | * foo
 |  | * bar
 |  | * baz
 | /
/