Change:
There are no details or instructions on how to validate the binary downloaded from this page via some form of checksum, sha256 or otherwise. For automation purposes, eg. ansible playbook, being able to validate any binary downloads is a requirement of project stakeholders.
The site doesn't allow browsing, but the file is there as kubectl.sha256 afterall. Might be worth mentioning this in the document?
/retitle Document how to validate kubectl binary against checksum / signature /language en /kind feature /triage accepted The page in question is
To fix this: update to use download links from for example also explain to readers that checksum files are available that they can use to compare binaries obtained from elsewhere for example The and shortcodes are useful for automatically filling in the current Kubernetes version. /help /sig cli
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : To fix this: update to use download links from explain to readers that checksum files are available that they can use to compare binaries obtained from elsewhere /sig cli Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I may be able to help with this /assign

Discussion:
1. Download the latest release with the command: <del> ``` curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl" ``` </del> <ins> ```bash curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" ``` </ins> <del> To download a specific version, replace the `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` portion of the command with the specific version. </del> <ins> {{< note >}} To download a specific version, replace the `$(curl -L -s https://dl.k8s.io/release/stable.txt)` portion of the command with the specific version. </ins> <del> For example, to download version {{< param "fullversion" >}} on Linux, type: ``` curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl ``` </del> <ins> For example, to download version {{< param "fullversion" >}} on Linux, type: </ins> <del> 2. Make the kubectl binary executable. </del> <ins> ```bash curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl ``` {{< /note >}} </ins> <del> ``` chmod +x ./kubectl ``` </del> <ins> 1. Validate the binary (optional) </ins> <del> 3. Move the binary in to your PATH. </del> <ins> Download the kubectl checksum file: </ins> <del> ``` sudo mv ./kubectl /usr/local/bin/kubectl ``` 4. Test to ensure the version you installed is up-to-date: </del> <ins> ```bash curl -LO "https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256" ``` </ins> <del> ``` kubectl version --client ``` </del> <ins> Validate the kubectl binary against the checksum file: ```bash echo "$(<kubectl.sha256) kubectl" | sha256sum --check ``` If valid, the output is: ```bash kubectl: OK ``` If the check fails, `sha256` exits with nonzero status and prints output similar to: ```bash kubectl: FAILED sha256sum: WARNING: 1 computed checksum did NOT match ``` {{< note >}} Download the same version of the binary and checksum. {{< /note >}} 1. Install kubectl ```bash sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl ``` {{< note >}} If you do not have root access on the target system, you can still install kubectl to the `~/.local/bin` directory: ```bash mkdir -p ~/.local/bin/kubectl mv ./kubectl ~/.local/bin/kubectl # and then add ~/.local/bin/kubectl to $PATH ``` {{< /note >}} 1. Test to ensure the version you installed is up-to-date: ```bash kubectl version --client ``` </ins> ### Install using native package management

1. Download the latest release: ```bash <del> curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl" </del> <ins> curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl" </ins> ``` <del> To download a specific version, replace the `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` portion of the command with the specific version. </del> <ins> {{< note >}} To download a specific version, replace the `$(curl -L -s https://dl.k8s.io/release/stable.txt)` portion of the command with the specific version. </ins> For example, to download version {{< param "fullversion" >}} on macOS, type: ```bash <del> curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl </del> <ins> curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl ``` {{< /note >}} 1. Validate the binary (optional) Download the kubectl checksum file: ```bash curl -LO "https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl.sha256" </ins> ``` <del> Make the kubectl binary executable. </del> <ins> Validate the kubectl binary against the checksum file: ```bash echo "$(<kubectl.sha256)  kubectl" | shasum -a 256 --check ``` If valid, the output is: ```bash kubectl: OK ``` If the check fails, `shasum` exits with nonzero status and prints output similar to: ```bash kubectl: FAILED shasum: WARNING: 1 computed checksum did NOT match ``` {{< note >}} Download the same version of the binary and checksum. {{< /note >}} 1. Make the kubectl binary executable. </ins> ```bash chmod +x ./kubectl ``` <del> 3. Move the binary in to your PATH. </del> <ins> 1. Move the kubectl binary to a file location on your system `PATH`. </ins> ```bash <del> sudo mv ./kubectl /usr/local/bin/kubectl </del> <ins> sudo mv ./kubectl /usr/local/bin/kubectl &&  sudo chown root: /usr/local/bin/kubectl </ins> ``` <del> 4. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```bash kubectl version --client

brew install kubernetes-cli ``` <del> 2. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```bash kubectl version --client

sudo port install kubectl ``` <del> 2. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```bash kubectl version --client

### Install kubectl binary with curl on Windows <del> 1. Download the latest release {{< param "fullversion" >}} from [this link](https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). </del> <ins> 1. Download the [latest release {{< param "fullversion" >}}](https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). </ins> Or if you have `curl` installed, use this command: <del> ```bash curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe </del> <ins> ```powershell curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe </ins> ``` <del> To find out the latest stable version (for example, for scripting), take a look at [https://storage.googleapis.com/kubernetes-release/release/stable.txt](https://storage.googleapis.com/kubernetes-release/release/stable.txt). </del> <ins> {{< note >}} To find out the latest stable version (for example, for scripting), take a look at [https://dl.k8s.io/release/stable.txt](https://dl.k8s.io/release/stable.txt). {{< /note >}} </ins> <del> 2. Add the binary in to your PATH. </del> <ins> 1. Validate the binary (optional) </ins> <del> 3. Test to ensure the version of `kubectl` is the same as downloaded: </del> <ins> Download the kubectl checksum file: </ins> <del> ```bash </del> <ins> ```powershell curl -LO https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe.sha256 ``` Validate the kubectl binary against the checksum file: - Using Command Prompt to manually compare `CertUtil`'s output to the checksum file downloaded: ```cmd CertUtil -hashfile kubectl.exe SHA256 type kubectl.exe.sha256 ``` - Using PowerShell to automate the verification using the `-eq` operator to get a `True` or `False` result: ```powershell $($(CertUtil -hashfile .kubectl.exe SHA256)[1] -replace " ", "") -eq $(type .kubectl.exe.sha256) ``` 1. Add the binary in to your `PATH`. 1. Test to ensure the version of `kubectl` is the same as downloaded: ```cmd </ins> kubectl version --client ``` {{< note >}} <del> [Docker Desktop for Windows](https://docs.docker.com/docker-for-windows/#kubernetes) adds its own version of `kubectl` to PATH. If you have installed Docker Desktop before, you may need to place your PATH entry before the one added by the Docker Desktop installer or remove the Docker Desktop's `kubectl`. </del> <ins> [Docker Desktop for Windows](https://docs.docker.com/docker-for-windows/#kubernetes) adds its own version of `kubectl` to `PATH`. If you have installed Docker Desktop before, you may need to place your `PATH` entry before the one added by the Docker Desktop installer or remove the Docker Desktop's `kubectl`. </ins> {{< /note >}} <del> ### Install with Powershell from PSGallery </del> <ins> ### Install with PowerShell from PSGallery </ins> <del> If you are on Windows and using [Powershell Gallery](https://www.powershellgallery.com/) package manager, you can install and update kubectl with Powershell. </del> <ins> If you are on Windows and using the [PowerShell Gallery](https://www.powershellgallery.com/) package manager, you can install and update kubectl with PowerShell. </ins> 1. Run the installation commands (making sure to specify a `DownloadLocation`): ```powershell Install-Script -Name 'install-kubectl' -Scope CurrentUser -Force install-kubectl.ps1 [-DownloadLocation <path>] <del> ``` </del> <ins> ``` </ins> {{< note >}} <del> If you do not specify a `DownloadLocation`, `kubectl` will be installed in the user's temp Directory. </del> <ins> If you do not specify a `DownloadLocation`, `kubectl` will be installed in the user's `temp` Directory. </ins> {{< /note >}} The installer creates `$HOME/.kube` and instructs it to create a config file. <del> 2. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```powershell kubectl version --client

{{< /tabs >}} <del> 2. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```powershell kubectl version --client ``` <del> 3. Navigate to your home directory: </del> <ins> 1. Navigate to your home directory: </ins> ```powershell # If you're using cmd.exe, run: cd %USERPROFILE% cd ~ ``` <del> 4. Create the `.kube` directory: </del> <ins> 1. Create the `.kube` directory: </ins> ```powershell mkdir .kube ``` <del> 5. Change to the `.kube` directory you just created: </del> <ins> 1. Change to the `.kube` directory you just created: </ins> ```powershell cd .kube ``` <del> 6. Configure kubectl to use a remote Kubernetes cluster: </del> <ins> 1. Configure kubectl to use a remote Kubernetes cluster: </ins> ```powershell New-Item config -type file

1. Install the [Google Cloud SDK](https://cloud.google.com/sdk/). <del> 2. Run the `kubectl` installation command: </del> <ins> 1. Run the `kubectl` installation command: </ins> ```shell gcloud components install kubectl ``` <del> 3. Test to ensure the version you installed is up-to-date: </del> <ins> 1. Test to ensure the version you installed is up-to-date: </ins> ```shell kubectl version --client

```bash echo 'source <(kubectl completion bash)' >>~/.bashrc ``` - Add the completion script to the `/etc/bash_completion.d` directory: ```bash kubectl completion bash >/etc/bash_completion.d/kubectl ``` If you have an alias for kubectl, you can extend shell completion to work with that alias: ```bash

```bash echo 'source <(kubectl completion bash)' >>~/.bash_profile ``` - Add the completion script to the `/usr/local/etc/bash_completion.d` directory: