Changes for version 1.110 - 2026-10-21
- Kubeconfig exec credentials are a Kubernetes::REST::AuthExec (k73): the plugin is run again when status.expirationTimestamp is within expiry_margin seconds (default 60), so a long-running client no longer gets 401 once an EKS/GKE/AKS token expires. Without an expirationTimestamp the plugin runs once, as before. A failed re-run warns and keeps the last token; there is no re-fetch after a 401. A plugin that returns clientCertificateData/clientKeyData instead of a token now dies with "only token plugins are supported ... client certificate".
- list() accepts limit, continue and resourceVersion, sent as query parameters (k74), and inflate_list hands the response's metadata (resourceVersion, continue, remainingItemCount) to the IO::K8s::List, so paging and list-then-watch work on the public API. The POD shows both.
- watch() no longer returns a resourceVersion that replays history (k69). It sends allowWatchBookmarks=true, takes the resourceVersion of BOOKMARK events as resume point and never passes a BOOKMARK to on_event. Started without a resourceVersion, the versions of the initial ADDED events are not a resume point: the return value is that of the first bookmark or of later events, and undef if the server sent no bookmark. An HTTP 410 on the watch request itself, with a resourceVersion given, croaks with the same "Watch expired (410 Gone)" as the ERROR event form.
- call_streaming of both IO backends rethrows an exception from the data callback unchanged (k71): a die in on_event or on_line now reaches the caller of watch() and log() instead of ending the stream silently under LWPIO (and instead of becoming a 599 under HTTPTinyIO). LWPIO reports transport failures - connect errors, a missing LWP::Protocol::https (k72), a body cut short - as status 599 with the message as content, as HTTPTinyIO always did, instead of an LWP-internal 500/501 or a 200. The contract is documented in Kubernetes::REST::Role::IO. A truncated body that LWPIO used to hand back as 200 is now an APIError with code 599.
- The in-cluster endpoint wraps an IPv6 KUBERNETES_SERVICE_HOST in brackets (k76): fd00:10:96::1 gives https://[fd00:10:96::1]:443 instead of an unparsable URL.
- Require LWP::Protocol::https (k72): it is a separate distribution since libwww-perl 6, and without it the default LWPIO backend answered every request to an https:// API server with LWP's internal 501.
- HTTPTinyIO passes verify_SSL and an explicit SSL_verify_mode (k75): ssl_verify_server => 1 now also checks the host name on HTTP::Tiny older than 0.083, and ssl_verify_server => 0 (kubeconfig insecure-skip-tls-verify) is honoured on HTTP::Tiny 0.083 and newer. HTTP::Tiny 0.054 or newer is recommended.
- Kubeconfig exec credential plugins are started without a shell (k70): every configured arg reaches the plugin as exactly one argument, so args with spaces, quotes, "$" or ";" no longer get split or interpreted. The plugin's stderr stays visible, and a failure croaks with "exec credential command CMD exited with status N" (or "could not be started"). Shell expansion in command or args no longer happens.
Documentation
Kubernetes CLI client using Kubernetes::REST
Generate IO::K8s classes from a CustomResourceDefinition
Run a command against a throwaway minikube cluster
Watch Kubernetes resources for changes
Modules
A Perl REST Client for the Kubernetes API
An HTTP error status answered by the Kubernetes API
Compatibility helper for deprecated v0 Admission Registration calls
Compatibility helper for deprecated v0 API Extensions calls
Compatibility helper for deprecated v0 API Registration calls
Compatibility helper for deprecated v0 Apps calls
Bearer token from an exec credential plugin, run again before it expires
Kubernetes API authentication token
Bearer token read from a file, re-read when the file changes
Compatibility helper for deprecated v0 Authentication calls
Compatibility helper for deprecated v0 Authorization calls
Compatibility helper for deprecated v0 Autoscaling calls
Compatibility helper for deprecated v0 Batch calls
CLI base class for Kubernetes::REST command-line tools
The create command of kube_client
The delete command of kube_client
The get command of kube_client
The raw command of kube_client
Generate IO::K8s classes from a CustomResourceDefinition
Bring up a minikube test cluster and run a command against it
Shared kubeconfig/auth options for CLI tools
CLI for watching Kubernetes resources
Compatibility helper for deprecated v0 Certificates calls
Compatibility helper for deprecated v0 Coordination calls
Compatibility helper for deprecated v0 Core calls
Compatibility helper for deprecated v0 error handling
Compatibility helper for deprecated v0 Events calls
Working examples for Kubernetes::REST with Minikube, K3s, and other clusters
HTTP request object
HTTP response object
HTTP client using HTTP::Tiny
Parse kubeconfig files and create Kubernetes::REST instances
HTTP client using LWP::UserAgent
A single log line from the Kubernetes Pod Log API
Compatibility helper for deprecated v0 Networking calls
Compatibility helper for deprecated v0 Policy calls
Compatibility helper for deprecated v0 RBAC calls
Compatibility helper for deprecated v0 remote errors
Interface role for HTTP backends
Compatibility helper for deprecated v0 Scheduling calls
Kubernetes API server connection configuration
Compatibility helper for deprecated v0 Storage calls
Base class for backwards-compatible v0 API group wrappers
A single event from the Kubernetes Watch API