Make the kubectl install resilient to flaky egress

Shipped

August 3, 2026 at 1:38 AM UTC

Author

Kamo

Commit

4ad091e

With the PATH bug fixed, the deploy then failed on a transient TLS drop while downloading kubectl: curl: (56) OpenSSL SSL_read: error:0A000119:decryption failed or bad record mac exitcode '56' Adds curl retries to both the version probe and the download, wraps them in a 3-attempt loop, and verifies the binary actually executes before proceeding so a truncated download fails here with a clear message rather than downstream.