Step 0.10 implementation:
- Recreate minikube with --apiserver-names=indri --listen-address=0.0.0.0
- Add kubectl-credential-1password exec plugin for 1Password integration
- Client certs fetched from 1Password on-demand (no private keys on disk)
- CA cert stored locally (not secret - public key for server verification)
Minikube role updates:
- Add minikube_apiserver_names and minikube_listen_address variables
- Update tasks to include remote access flags
This mirrors the 1Password SSH agent pattern - biometric auth required
for each kubectl command that needs credentials.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
