One new command for kubehz agent keys and two dependency updates. No change to the piped output of the parity cases.

Added

• lo kubehz token is the kubectl exec credential plugin for a kubehz agent key: a machine identity for an AI agent or a pipeline. It runs the OAuth client_credentials grant and prints an ExecCredential. --format token prints the bare access token, which works as KUBEHZ_TOKEN against the platform api (#238).

  • The client secret comes from KUBEHZ_AGENT_CLIENT_SECRET or --secret-file (a pipe works). It is never a flag, because every user on the machine can read a command line.
  • The access token is cached in ${XDG_CACHE_HOME:-~/.cache}/lok8s/kubehz-token/ (mode 0600) until five minutes before it expires. --no-cache asks the endpoint every time.
  • The command tries again after 0.25, 0.5 and 1 s when the connection fails, the endpoint answers with a 5xx status, or it answers invalid_client (a key made a moment ago). An attempt ends after 30 seconds and is not tried again.
  • Its output is a bearer token. Thus the command is hidden from lo kubehz --help, no lo mcp server offers it as a tool, and the lo chat defaults deny it.

  The kubehz guide has a new section, "Agent keys".

Security

• containerd 1.7.36 and oras-go 2.6.2, for GO-2026-6597 and GO-2026-6499. Both modules are indirect (through Helm), and both fixes are patch releases.

Upgrade

Nothing to do.